Ipswitch vulnerabilities
106 vulnerabilities
Known vulnerabilities in Ipswitch products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 26 products.
Products
26- Imail38 vulnerabilities
- Ws Ftp Server13 vulnerabilities
- Imail Server12 vulnerabilities
- Ipswitch Collaboration Suite10 vulnerabilities
- Whatsup Professional7 vulnerabilities
- Ws Ftp7 vulnerabilities
- Ws Ftp Pro6 vulnerabilities
- Moveit Dmz5 vulnerabilities
- Imserver3 vulnerabilities
- Instant Messaging3 vulnerabilities
- Moveit Mobile3 vulnerabilities
- Moveit Transfer3 vulnerabilities
- Whatsup3 vulnerabilities
- Imail Plus2 vulnerabilities
- Imail Client1 vulnerabilities
- Imail Express1 vulnerabilities
- Imail Premium1 vulnerabilities
- Imail Secure Server1 vulnerabilities
- Ipswitch Secure Server1 vulnerabilities
- Moveit1 vulnerabilities
- Moveit Transfer 20171 vulnerabilities
- Tftp Server1 vulnerabilities
- Whatsup Gold1 vulnerabilities
- Whatsup Small Business1 vulnerabilities
- Wincom Lpd1 vulnerabilities
- Ws Ftp Home1 vulnerabilities
CVE-2018-6545ipswitchmoveit
EPSS score1.54%
Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks.CVE-2003-0772ipswitchws_ftp_server+1EPSS score84.88%
Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long (1) APPE (append) or (2) STAT (status) arguments.CVE-2015-7680ipswitchmoveit_dmzEPSS score2.15%
Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.CVE-2015-7678ipswitchmoveit_mobileEPSS score0.91%
Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.CVE-2015-7679ipswitchmoveit_mobileEPSS score1.43%
Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/.CVE-2015-7675ipswitchmoveit_dmz+1EPSS score3.11%
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx.CVE-2015-7676ipswitchmoveit_dmzEPSS score1.78%
Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.CVE-2015-7677ipswitchmoveit_dmzEPSS score2.95%
The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll.CVE-2007-2213ipswitchws_ftpEPSS score4.61%
Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WS_FTP Home and Professional 2007 allows remote attackers to cause a denial of service (NULL dereference and application crash) via unspecified vectors related to "improper arguments."CVE-2007-2795ipswitchimailEPSS score24.45%
Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long SUBSCRIBE IMAP command, which triggers a stack-based buffer overflow in the IMAP Daemon.CVE-2007-1637ipswitchimail+3EPSS score5.64%
Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control.CVE-2007-0666ipswitchws_ftp_serverEPSS score1.92%
Ipswitch WS_FTP Server 5.04 allows FTP site administrators to execute arbitrary code on the system via a long input string to the (1) iFTPAddU or (2) iFTPAddH file, or to a (3) edition module.CVE-2007-0330ipswitchws_ftp_proEPSS score3.45%
Buffer overflow in wsbho2k0.dll, as used by wsftpurl.exe, in Ipswitch WS_FTP 2007 Professional allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long ftp:// URL in an HTML document, and possibly other vectors.CVE-2007-0665ipswitchws_ftp_proEPSS score3.27%
Format string vulnerability in the SCP module in Ipswitch WS_FTP 2007 Professional might allow remote attackers to execute arbitrary commands via format string specifiers in the filename, related to the SHELL WS_FTP script command.CVE-2007-4345ipswitchimail_client+1EPSS score3.17%
Buffer overflow in IMail Client 9.22, as shipped with IPSwitch IMail Server 2006.22, allows remote attackers to execute arbitrary code via a long boundary parameter in a multipart MIME e-mail message.CVE-2007-5094ipswitchimailEPSS score4.36%
Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute arbitrary code via a set of four different e-mail messages with a long boundary parameter in a certain malformed Content-Type header line, the string "MIME" by itself on a line in the header, and a long Content-Transfer-Encoding header line.CVE-2007-3925ipswitchimail_server+1EPSS score84.67%
Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to execute arbitrary code via the (1) Search or (2) Search Charset command.CVE-2007-3823ipswitchws_ftpEPSS score25.17%
The Logging Server (Logsrv.exe) in IPSwitch WS_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp.CVE-2007-3926ipswitchimail_serverEPSS score2.92%
Ipswitch IMail Server 2006 before 2006.21 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving an "overwritten destructor."CVE-2007-3959ipswitchimserver+1EPSS score6.46%
The IM Server (aka IMserve or IMserver) 2.0.5.30 and probably earlier in Ipswitch Instant Messaging before 2.07 in Ipswitch Collaboration Suite (ICS) allows remote attackers to cause a denial of service (daemon crash) via certain data to TCP port 5179 that overwrites a destructor, as reachable by the (1) DoAttachVideoSender, (2) DoAttachVideoReceiver, (3) DoAttachAudioSender, and (4) DoAttachAudioReceiver functions.