Progress Whatsup Gold vulnerabilities, page 3
62 vulnerabilities
Known vulnerabilities in Progress Whatsup Gold, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-5015progress software corporationwhatsup gold+1
EPSS score0.53%
In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.CVE-2024-5010progress software corporationwhatsup gold+1EPSS score69.95%
In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted
unauthenticated
HTTP request can lead to a disclosure of sensitive information.CVE-2024-5008progress software corporationwhatsup gold+1EPSS score17.33%
In WhatsUp Gold versions released before 2023.1.3,
an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController.CVE-2024-6671progress software corporationwhatsup gold+1EPSS score18.99%
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.CVE-2024-6672progress software corporationwhatsup gold+1EPSS score0.71%
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.CVE-2024-6670progress software corporationwhatsup gold+1KEVRansomwareEPSS score93.00%
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.CVE-2024-12108progress software corporationwhatsup gold+1EPSS score7.68%
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.CVE-2024-12106progress software corporationwhatsup gold+1EPSS score9.48%
In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.CVE-2024-12105progress software corporationwhatsup gold+1EPSS score41.68%
In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure.CVE-2024-8785progress software corporationwhatsup gold+1EPSS score9.66%
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.CVE-2026-65940progress software corporationwhatsup gold+1EPSS score0.35%
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.CVE-2026-65941progress software corporationwhatsup gold+1EPSS score0.68%
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.CVE-2026-65938progress software corporationwhatsup gold+1EPSS score0.25%
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.CVE-2026-65937progress software corporationwhatsup gold+1EPSS score0.41%
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.CVE-2026-65939progress software corporationwhatsup gold+1EPSS score0.38%
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.CVE-2023-6365progress software corporationwhatsup gold+1EPSS score0.51%
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group.
If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.CVE-2023-6368progress software corporationwhatsup gold+1EPSS score0.55%
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold.CVE-2023-6595progress software corporationwhatsup gold+1EPSS score0.80%
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.CVE-2023-6366progress software corporationwhatsup gold+1EPSS score0.51%
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center.
If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.CVE-2023-6367progress software corporationwhatsup gold+1EPSS score0.51%
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles.
If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.