CVE & Exploit Intelligence Database

CVE-2024-12108 9.6 CRITICAL EPSS 0.12

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.

CWE-290 Dec 31, 2024

CVE-2024-12106 9.4 CRITICAL EPSS 0.13

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

CWE-306 Dec 31, 2024

CVE-2024-8785 9.8 CRITICAL EPSS 0.06

In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.

CWE-648 Dec 02, 2024

CVE-2024-46909 9.8 CRITICAL EPSS 0.32

In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.

CWE-16 Dec 02, 2024

CVE-2024-7763 9.8 CRITICAL EPSS 0.00

In WhatsUp Gold versions released before 2024.0.0,  an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials.

CWE-287 Oct 24, 2024

CVE-2024-8015 9.1 CRITICAL EPSS 0.01

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

CWE-470 Oct 09, 2024

CVE-2024-6671 9.8 CRITICAL EXPLOITED NUCLEI EPSS 0.74

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CWE-89 Aug 29, 2024

CVE-2024-6670 9.8 CRITICAL KEV RANSOMWARE 2 PoCs Analysis NUCLEI EPSS 0.94

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CWE-89 Aug 29, 2024

CVE-2024-6327 9.9 CRITICAL EPSS 0.03

In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.

CWE-502 Jul 24, 2024

CVE-2024-4885 9.8 CRITICAL KEV 1 PoC Analysis NUCLEI EPSS 0.94

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

CWE-22 Jun 25, 2024

CVE-2024-4884 9.8 CRITICAL EPSS 0.58

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges.

CWE-78 Jun 25, 2024

CVE-2024-4883 9.8 CRITICAL 1 PoC Analysis EPSS 0.91

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

CWE-78 Jun 25, 2024

CVE-2024-5806 9.1 CRITICAL EXPLOITED 3 PoCs Analysis EPSS 0.90

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

CWE-287 Jun 25, 2024

CVE-2024-5805 9.1 CRITICAL EPSS 0.01

Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0.

CWE-287 Jun 25, 2024

CVE-2024-2389 10.0 CRITICAL EXPLOITED 3 PoCs Analysis NUCLEI EPSS 0.94

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

CWE-78 Apr 02, 2024

CVE-2024-1800 9.9 CRITICAL 3 PoCs Analysis EPSS 0.76

In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.

CWE-502 Mar 20, 2024

CVE-2024-1403 10.0 CRITICAL 1 PoC Analysis EPSS 0.17

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.  

CWE-305 Feb 27, 2024

CVE-2024-1212 10.0 CRITICAL KEV 7 PoCs Analysis NUCLEI EPSS 0.94

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CWE-78 Feb 21, 2024

CVE-2023-40051 9.1 CRITICAL EPSS 0.00

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

CWE-434 Jan 18, 2024

CVE-2023-42659 9.1 CRITICAL EPSS 0.00

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

CWE-434 Nov 07, 2023