Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
76 results · page 1 of 2
Oct 14, 2026Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).CVE-2026-89077 · Other software · Progress · reported by security@progress.comHigh 7.5
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).CVE-2026-89076 · Other software · Progress · reported by security@progress.comHigh 7.2
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.CVE-2026-89075 · Other software · Progress · reported by security@progress.comHigh 7.3
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.CVE-2026-89074 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.CVE-2026-89073 · Other software · Progress · reported by security@progress.comHigh 7.5
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).CVE-2026-89072 · Other software · Progress · reported by security@progress.comHigh 7.5
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).CVE-2026-89071 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).CVE-2026-89070 · Other software · Progress · reported by security@progress.comHigh 7.5
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).CVE-2026-89069 · Other software · Progress · reported by security@progress.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).CVE-2026-89068 · Other software · Progress · reported by security@progress.comHigh 8.1
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.CVE-2026-89067 · Other software · Progress · reported by security@progress.comHigh 8.8
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.CVE-2026-87093 · Other software · Progress · reported by security@progress.comHigh 8.8
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 27, 2026A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allCVE-2026-59690 · Other software · Progress Software · reported by security@progress.comHigh 8
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 27, 2026An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authCVE-2026-59689 · Other software · Progress Software · reported by security@progress.comHigh 8
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 27, 2026An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authentCVE-2026-59688 · Other software · Progress Software · reported by security@progress.comHigh 8.4
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 27, 2026An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authentCVE-2026-59687 · Other software · Progress Software · reported by security@progress.comHigh 8.4
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 27, 2026An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authentCVE-2026-59686 · Other software · Progress Software · reported by security@progress.comHigh 8.4
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 23, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.CVE-2026-15968 · Other software · Progress · reported by security@progress.comHigh 7.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Insufficient session expiration vulnerability in Progress MOVEit Transfer.CVE-2026-15967 · Other software · Progress · reported by security@progress.comHigh 7.5
Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.CVE-2026-15966 · Other software · Progress · reported by security@progress.comHigh 7.5
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Improper Authentication vulnerability in Progress MOVEit Transfer.CVE-2026-10697 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).CVE-2026-8801 · Other software · Progress · reported by security@progress.comLow 3.5
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).CVE-2026-8800 · Other software · Progress · reported by security@progress.comLow 2.7
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).CVE-2026-8651 · Other software · Progress · reported by security@progress.comLow 3.7
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).CVE-2026-8650 · Other software · Progress · reported by security@progress.comMedium 4.5
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-8649 · Other software · Progress · reported by security@progress.comMedium 6.4
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).CVE-2026-11903 · Other software · Progress · reported by security@progress.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 8, 2026Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-10699 · Other software · Progress · reported by security@progress.comHigh 7.5
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 8, 2026Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-10698 · Other software · Progress · reported by security@progress.comHigh 7.2
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
May 20, 2026Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.CVE-2026-8488 · Other software · Progress Software · reported by security@progress.comMedium 4.3
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.CVE-2026-8487 · Other software · Progress Software · reported by security@progress.comMedium 6.5
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.CVE-2026-8486 · Other software · Progress Software · reported by security@progress.comMedium 5.3
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.CVE-2026-8485 · Other software · Progress Software · reported by security@progress.comMedium 5.9
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.CVE-2026-5174 · Other software · Progress Software · reported by security@progress.comHigh 7.7
Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Apr 30, 2026Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.CVE-2026-4670 · Other software · Progress Software · reported by security@progress.comCritical 9.8
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jan 7, 2026Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023CVE-2025-11235 · Other software · Progress · reported by security@progress.comLow 3.7
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.CVE-2025-13147 · Other software · Progress · reported by security@progress.comMedium 5.3
Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.progress.comdocs.progress.com
Oct 29, 2025Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, fromCVE-2025-10932 · Other software · Progress · reported by security@progress.comHigh 8.2
Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Mar 19, 2025Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This iCVE-2025-2324 · Other software · Progress · reported by security@progress.comMedium 5.9
Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Jul 29, 2024Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0CVE-2024-6576 · Other software · Progress · reported by security@progress.comHigh 7.3
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Jun 25, 2024Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.CVE-2024-5806 · Other software · Progress · reported by security@progress.comCritical 9.1
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Jun 25, 2024Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0.CVE-2024-5805 · Other software · Progress · reported by security@progress.comCritical 9.1
Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0.
- Product
- MOVEit Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
May 22, 2024The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.CVE-2024-4563 · Other software · Progress Software Corporation · reported by security@progress.comMedium 6.1
The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Mar 20, 2024 In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerabiCVE-2024-2291 · Other software · Progress Software · reported by security@progress.comMedium 4.3
In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Jan 17, 2024 In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue CVE-2024-0396 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Nov 29, 2023 In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with groCVE-2023-6218 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.2
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Nov 29, 2023 In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerabCVE-2023-6217 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability CVE-2023-42660 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.8
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scriptiCVE-2023-42656 · Other software · Progress Software Corporation · reported by security@progress.comMedium 6.1
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability CVE-2023-40043 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.2
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.