Progress Software Corporation Whatsup Gold vulnerabilities
42 vulnerabilities
Known vulnerabilities in Progress Software Corporation Whatsup Gold, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-2572progress software corporationwhatsup gold+1
EPSS score0.26%
In WhatsUp Gold versions released before 2024.0.3, a
database manipulation
vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup.CVE-2024-4562progress software corporationwhatsup gold+1EPSS score0.38%
In WhatsUp Gold versions released before 2023.1.2 ,
an SSRF vulnerability exists in Whatsup Gold's
Issue exists in the HTTP Monitoring functionality.
Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.CVE-2024-4884progress software corporationwhatsup gold+1EPSS score24.31%
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController
allows execution of commands with iisapppool\nmconsole privileges.CVE-2024-4883progress software corporationwhatsup gold+1EPSS score64.53%
In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.CVE-2024-4561progress software corporationwhatsup gold+1EPSS score0.43%
In WhatsUp Gold versions released before 2023.1.2 ,
a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.CVE-2024-4885progress software corporationwhatsup gold+1KEVEPSS score99.29%
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The
WhatsUp.ExportUtilities.Export.GetFileWithoutZip
allows execution of commands with iisapppool\nmconsole privileges.CVE-2024-7763progress software corporationwhatsup gold+1EPSS score0.61%
In WhatsUp Gold versions released before 2024.0.0,
an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials.CVE-2024-46908progress software corporationwhatsup gold+1EPSS score2.24%
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required)
to achieve privilege escalation to the admin account.CVE-2024-46906progress software corporationwhatsup gold+1EPSS score40.37%
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.CVE-2024-46907progress software corporationwhatsup gold+1EPSS score2.24%
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.CVE-2024-46905progress software corporationwhatsup gold+1EPSS score2.24%
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permissions required) to achieve privilege escalation to the admin account.CVE-2024-46909progress software corporationwhatsup gold+1EPSS score48.95%
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.CVE-2024-5011progress software corporationwhatsup gold+1EPSS score47.09%
In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.CVE-2024-5018progress software corporationwhatsup gold+1EPSS score0.77%
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory .CVE-2024-5012progress software corporationwhatsup gold+1EPSS score0.45%
In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library.CVE-2024-5019progress software corporationwhatsup gold+1EPSS score0.77%
In WhatsUp Gold versions released before 2023.1.3,
an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges.CVE-2024-5014progress software corporationwhatsup gold+1EPSS score0.48%
In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.CVE-2024-5017progress software corporationwhatsup gold+1EPSS score1.64%
In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to information disclosure.CVE-2024-5013progress software corporationwhatsup gold+1EPSS score0.85%
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service
vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.CVE-2024-5009progress software corporationwhatsup gold+1EPSS score17.42%
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.