Flowmon Anomaly Detection System
Monthly
Stored cross-site scripting in Progress Flowmon Anomaly Detection System allows an adjacent-network attacker without credentials to embed JavaScript payloads in crafted network traffic that, when ingested by Flowmon ADS and viewed by an authenticated administrator, executes arbitrary script in the admin's browser context. Affected versions are all 12.x releases prior to 12.5.5 and all 13.x releases prior to 13.0.3. Successful exploitation can yield session hijacking, unauthorized administrative actions within the Flowmon platform, or exfiltration of sensitive network intelligence visible to the logged-in user. No public exploit code or CISA KEV listing is identified at time of analysis.
Reflected cross-site scripting in Progress Flowmon Anomaly Detection System (ADS) versions prior to 12.5.5 and 13.0.3 allows an unauthenticated attacker to execute arbitrary JavaScript within an administrator's authenticated browser session by tricking them into clicking a crafted link. Because the payload executes with the full privilege context of the logged-in admin, the attacker can silently trigger administrative actions - such as modifying detection policies, exfiltrating sensitive network telemetry, or altering system configuration - without the victim's awareness. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability.
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands. [CVSS 8.8 HIGH]
Stored cross-site scripting in Progress Flowmon Anomaly Detection System allows an adjacent-network attacker without credentials to embed JavaScript payloads in crafted network traffic that, when ingested by Flowmon ADS and viewed by an authenticated administrator, executes arbitrary script in the admin's browser context. Affected versions are all 12.x releases prior to 12.5.5 and all 13.x releases prior to 13.0.3. Successful exploitation can yield session hijacking, unauthorized administrative actions within the Flowmon platform, or exfiltration of sensitive network intelligence visible to the logged-in user. No public exploit code or CISA KEV listing is identified at time of analysis.
Reflected cross-site scripting in Progress Flowmon Anomaly Detection System (ADS) versions prior to 12.5.5 and 13.0.3 allows an unauthenticated attacker to execute arbitrary JavaScript within an administrator's authenticated browser session by tricking them into clicking a crafted link. Because the payload executes with the full privilege context of the logged-in admin, the attacker can silently trigger administrative actions - such as modifying detection policies, exfiltrating sensitive network telemetry, or altering system configuration - without the victim's awareness. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability.
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands. [CVSS 8.8 HIGH]