Progress Software WS_FTP Unauthenticated Remote Code Execution

This module exploits an unsafe .NET deserialization vulnerability to achieve unauthenticated remote code execution against a vulnerable WSFTP server running the Ad Hoc Transfer module. All versions of WSFTP Server prior to 2020.0.4 version 8.7.4 and 2022.0.2 version 8.8.2 are vulnerable to this...

WS_FTP Server Cross-Site Scripting Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A cross-site scripting vulnerability exists in WSFTP Server versions prior to 8.8.2. An attacker could exploit this vulnerability to execute malicious JavaScript in the victim's browser...

Progress MOVEit Transfer < 2021.1.8 / 2022.0 < 2022.0.8, 2022.1 < 2022.1.9 / 2023.0 < 2023.0.6 Multiple Vulnerabilities (September 2023)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is prior to 2021.1.8 / 2022.0 2022.0.8, 2022.1 2022.1.9 / 2023.0 2023.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in Progress Community article 000241629. - In Progres...

Progress MOVEit Transfer Cross-Site Scripting Vulnerability

Progress MOVEit Transfer is a secure hosted file transfer application from Progress. A security vulnerability exists in Progress MOVEit Transfer. An attacker could exploit the vulnerability to execute malicious JavaScript in the victim's browser environment...

PT-2023-24730 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

Exploit for SQL Injection in Progress Moveit_Cloud

MOVEit Exploit an exploit of POC for CVE-2023-34362 affe...

Malicious code in usaa-progress-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bda554520601e00fc54bc5db28faf1d16fd41ea1d00cc51dc62e9a8b7e4eb1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in usaa-progress-indicator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1530 Malicious code in usaa-progress-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bda554520601e00fc54bc5db28faf1d16fd41ea1d00cc51dc62e9a8b7e4eb1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in progress-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7c85d0514dd6025ca318ffb0b25040d4c1ef626b00125f13d43ea506d3299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in progress-player

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-28864

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. The data...

CVE-2023-28864

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. The data...

PT-2023-22015 · Progress · Progress Chef Infra Server

Name of the Vulnerable Software and Affected Versions: Progress Chef Infra Server versions prior to 15.7 Description: The issue allows a local attacker to access sensitive information by exploiting a world-readable temporary backup path at /var/opt/opscode/local-mode-cache/backup. This results in...

CVE-2023-28864

Progress Chef Infra Server before 15.7 is affected by CVE-2023-28864. A local attacker can exploit a world-readable /var/opt/opscode/local-mode-cache/backup temporary backup path to access sensitive information, leading to disclosure of all indexed node data because OpenSearch credentials are exp...

MOVEit Transfer fixes three new vulnerabilities

The Cybersecurity and Infrastructure Security Agency CISA has warned about three new vulnerabilities in Progress Software's MOVEit software. A cybercriminal could exploit some of these vulnerabilities to obtain sensitive information. In the advisory, CISA encouraged users to review Progress MOVEi...

Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software

Progress Software has announced the discovery and patching of a critical SQL injection vulnerability in MOVEit Transfer, popular software used for secure file transfer. In addition, Progress Software has patched two other high-severity vulnerabilities. The identified SQL injection vulnerability,...

Progress MOVEit Transfer < 2020.1.11 / 2021.0 < 2021.0.9 / 2021.1 < 2021.1.7 / 2022.0 < 2022.0.7, 2022.1 < 2022.1.8 / 2023.0 < 2023.0.4 Multiple Vulnerabilities (July 2023)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is prior to 2020.1.11 / 2021.0 2021.0.9 / 2021.1 2021.1.7 / 2022.0 2022.0.7, 2022.1 2022.1.8 / 2023.0 2023.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in Progress...