Fortra
Monthly
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.
Unauthenticated remote attackers who can reach the boks_autoregisterd autoregistration service in Fortra's Core Privileged Access Manager (BoKS) can trigger a stack-based buffer overflow while the daemon processes a client response, potentially corrupting memory and achieving code execution under the daemon's privileges, as reflected by the maximum-severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected deployments are those running the BoKS autoregistration/enrollment daemon on a network segment reachable by the attacker, which in most environments is the internal management or agent network rather than the public internet. No public exploit identified at time of analysis; the issue was reported to the vendor by Fortra, and the only reference provided is Fortra's product security advisory FI-2026-017, with no CISA KEV listing and no EPSS data supplied.
Remote unauthenticated attackers can crash the boks_portmux daemon in Fortra BoKS Manager by sending a single malformed TLS ClientHello to its custom TLS listener, and repeated requests can sustain a denial-of-service condition because the daemon is normally restarted automatically. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this as a high-availability-impact issue; no public exploit code, KEV listing, or active exploitation has been identified at time of analysis.
Command injection in Fortra BoKS Manager's crlserver component allows an authenticated principal holding the delegated CRL-URL-add capability to run arbitrary shell commands as root on the BoKS Master, yielding full compromise of the host that anchors the BoKS trust domain. Three delivery paths exist: the BCC administration console and the WSI REST/SOAP API are network-reachable and require no local sudo or suexec rule, while the cacrl command-line path needs a sudo/suexec rule for non-root use. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) confirms a network-reachable, scope-changing, high-integrity/high-availability impact; exploitation is gated by the attacker already possessing CRL-URL-add authorization plus an active crlserver on a BoKS Master, and no public exploit code was identified at time of analysis.
Fortra BoKS Manager's bccgethostcert utility writes predictably named temporary files under the BOKS_tmp directory without first setting a restrictive umask, so a local, authenticated low-privileged user on a BoKS Master host can capture CA secret or host private-key material - either by reading the files during the window in which a privileged operator runs the utility, or by recovering CA secret material left behind after a successful certificate creation. The issue is scored 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, CWE-377), and its confidentiality and integrity impact is high precisely because the leaked material is CA-level keying material rather than ordinary application data. Exploitation is access-gated rather than remote: it requires a Master-local account, read access to files under BOKS_tmp, and the utility actually being invoked by a privileged user. No public exploit code has been identified at time of analysis, and KEV/EPSS signals were not provided in the source data.
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the central BoKS Master when that client is selected for upgrade or patching. The flaw sits in the client version-handling logic of the legacy tar-based upgrade/patch tooling, turning a single rogue managed endpoint into a foothold on the security control plane. It is not in CISA KEV and no public exploit is identified at time of analysis; EPSS is low at 0.57% (43rd percentile), and CISA SSVC records exploitation as 'none' though technical impact as 'total'.
Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attackers to execute arbitrary OS commands with the privileges of the boks_autoregisterd service. The flaw resides in autoregistration processing and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, though no public exploit identified at time of analysis. Because BoKS is a privileged access management product, successful exploitation can directly undermine the security control plane intended to protect enterprise privileged accounts.
Remote code execution in Fortra's GoAnywhere Managed File Transfer arises when the License Servlet deserializes an attacker-controlled object accompanied by a validly forged license response signature, enabling command injection (CWE-77). Any actor able to forge that signature can reach the servlet over the network without authentication and execute arbitrary commands on the host. This flaw is confirmed actively exploited (CISA KEV), has publicly available exploit code, and carries an unusually high EPSS of 58.80% (98th percentile), placing it firmly in emergency-patch territory.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.
Incorrect privilege assignment in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0 causes the `tetool import` command to assign elevated or incorrect effective permissions to newly created users when FIM is actively running during import. The flaw is compounded when the import operation also creates or modifies roles or role-permission relationships, meaning users may silently receive access levels beyond what was configured. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high-privilege prerequisite that limits realistic exposure to administrative misuse or insider threat scenarios.
Stored cross-site scripting in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0.1 allows a highly privileged authenticated user to inject persistent script content into node or database configuration fields within the Asset View UI component. When another user subsequently views the affected Asset View page, the stored payload executes in their browser context rather than being safely escaped, enabling session hijacking, credential theft, or unauthorized UI manipulation against that victim. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
User-controlled HTTP headers in Fortra GoAnywhere MFT prior to version 7.10.0 enable remote unauthenticated attackers to trigger arbitrary DNS lookups and execute DNS rebinding attacks, leading to information disclosure and potential service degradation. The vulnerability exploits improper handling of attacker-supplied header values in network requests, allowing reconnaissance of internal infrastructure and circumvention of network segmentation controls.
SSH key brute-force attack against GoAnywhere MFT SFTP service allows remote unauthenticated attackers to compromise Web User accounts configured with SSH key authentication in versions prior to 7.10.0. The SFTP service fails to enforce login attempt limits when SSH key authentication is used, enabling attackers to programmatically guess private keys. EPSS and KEV data not provided; vendor Fortra disclosed this vulnerability directly (FI-2026-004).
Improper session timeout handling in Fortra GoAnywhere MFT prior to version 7.10.0 allows unauthenticated remote attackers to bypass SAML authentication and redirect users to the regular login page, potentially enabling credential harvesting or session hijacking attacks. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but affects all web users configured with SAML single sign-on, creating an information disclosure risk through unexpected authentication flow exposure.
SFTP authentication in GoAnywhere MFT prior to 7.10.0 allows remote unauthenticated attackers to bypass login attempt limits when targeting accounts configured with SSH key authentication, enabling brute force attacks against SSH private keys. The vulnerability affects the SFTP service specifically when Web Users are configured for SSH key-based login, exposing organizations to credential stuffing attacks. EPSS exploitation probability data not available; no evidence of active exploitation or public exploit code at time of analysis, though the attack vector is straightforward given network accessibility and low complexity (AV:N/AC:L/PR:N).
Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 use a static initialization vector (IV) for encryption, allowing authenticated administrative users to brute-force decryption of encrypted data. The vulnerability requires high-privilege access and computational effort but results in complete confidentiality loss of encrypted values. No public exploit code or active exploitation has been confirmed at time of analysis.
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.
Unauthenticated remote attackers who can reach the boks_autoregisterd autoregistration service in Fortra's Core Privileged Access Manager (BoKS) can trigger a stack-based buffer overflow while the daemon processes a client response, potentially corrupting memory and achieving code execution under the daemon's privileges, as reflected by the maximum-severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected deployments are those running the BoKS autoregistration/enrollment daemon on a network segment reachable by the attacker, which in most environments is the internal management or agent network rather than the public internet. No public exploit identified at time of analysis; the issue was reported to the vendor by Fortra, and the only reference provided is Fortra's product security advisory FI-2026-017, with no CISA KEV listing and no EPSS data supplied.
Remote unauthenticated attackers can crash the boks_portmux daemon in Fortra BoKS Manager by sending a single malformed TLS ClientHello to its custom TLS listener, and repeated requests can sustain a denial-of-service condition because the daemon is normally restarted automatically. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this as a high-availability-impact issue; no public exploit code, KEV listing, or active exploitation has been identified at time of analysis.
Command injection in Fortra BoKS Manager's crlserver component allows an authenticated principal holding the delegated CRL-URL-add capability to run arbitrary shell commands as root on the BoKS Master, yielding full compromise of the host that anchors the BoKS trust domain. Three delivery paths exist: the BCC administration console and the WSI REST/SOAP API are network-reachable and require no local sudo or suexec rule, while the cacrl command-line path needs a sudo/suexec rule for non-root use. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) confirms a network-reachable, scope-changing, high-integrity/high-availability impact; exploitation is gated by the attacker already possessing CRL-URL-add authorization plus an active crlserver on a BoKS Master, and no public exploit code was identified at time of analysis.
Fortra BoKS Manager's bccgethostcert utility writes predictably named temporary files under the BOKS_tmp directory without first setting a restrictive umask, so a local, authenticated low-privileged user on a BoKS Master host can capture CA secret or host private-key material - either by reading the files during the window in which a privileged operator runs the utility, or by recovering CA secret material left behind after a successful certificate creation. The issue is scored 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, CWE-377), and its confidentiality and integrity impact is high precisely because the leaked material is CA-level keying material rather than ordinary application data. Exploitation is access-gated rather than remote: it requires a Master-local account, read access to files under BOKS_tmp, and the utility actually being invoked by a privileged user. No public exploit code has been identified at time of analysis, and KEV/EPSS signals were not provided in the source data.
OS command injection in Fortra BoKS Manager (Core Privileged Access Manager) lets a malicious or already-compromised legacy tar-installed client execute arbitrary commands on the central BoKS Master when that client is selected for upgrade or patching. The flaw sits in the client version-handling logic of the legacy tar-based upgrade/patch tooling, turning a single rogue managed endpoint into a foothold on the security control plane. It is not in CISA KEV and no public exploit is identified at time of analysis; EPSS is low at 0.57% (43rd percentile), and CISA SSVC records exploitation as 'none' though technical impact as 'total'.
Remote unauthenticated command injection in Fortra's Core Privileged Access Manager (BoKS) allows network-adjacent attackers to execute arbitrary OS commands with the privileges of the boks_autoregisterd service. The flaw resides in autoregistration processing and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, though no public exploit identified at time of analysis. Because BoKS is a privileged access management product, successful exploitation can directly undermine the security control plane intended to protect enterprise privileged accounts.
Remote code execution in Fortra's GoAnywhere Managed File Transfer arises when the License Servlet deserializes an attacker-controlled object accompanied by a validly forged license response signature, enabling command injection (CWE-77). Any actor able to forge that signature can reach the servlet over the network without authentication and execute arbitrary commands on the host. This flaw is confirmed actively exploited (CISA KEV), has publicly available exploit code, and carries an unusually high EPSS of 58.80% (98th percentile), placing it firmly in emergency-patch territory.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.
Incorrect privilege assignment in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0 causes the `tetool import` command to assign elevated or incorrect effective permissions to newly created users when FIM is actively running during import. The flaw is compounded when the import operation also creates or modifies roles or role-permission relationships, meaning users may silently receive access levels beyond what was configured. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high-privilege prerequisite that limits realistic exposure to administrative misuse or insider threat scenarios.
Stored cross-site scripting in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0.1 allows a highly privileged authenticated user to inject persistent script content into node or database configuration fields within the Asset View UI component. When another user subsequently views the affected Asset View page, the stored payload executes in their browser context rather than being safely escaped, enabling session hijacking, credential theft, or unauthorized UI manipulation against that victim. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
User-controlled HTTP headers in Fortra GoAnywhere MFT prior to version 7.10.0 enable remote unauthenticated attackers to trigger arbitrary DNS lookups and execute DNS rebinding attacks, leading to information disclosure and potential service degradation. The vulnerability exploits improper handling of attacker-supplied header values in network requests, allowing reconnaissance of internal infrastructure and circumvention of network segmentation controls.
SSH key brute-force attack against GoAnywhere MFT SFTP service allows remote unauthenticated attackers to compromise Web User accounts configured with SSH key authentication in versions prior to 7.10.0. The SFTP service fails to enforce login attempt limits when SSH key authentication is used, enabling attackers to programmatically guess private keys. EPSS and KEV data not provided; vendor Fortra disclosed this vulnerability directly (FI-2026-004).
Improper session timeout handling in Fortra GoAnywhere MFT prior to version 7.10.0 allows unauthenticated remote attackers to bypass SAML authentication and redirect users to the regular login page, potentially enabling credential harvesting or session hijacking attacks. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but affects all web users configured with SAML single sign-on, creating an information disclosure risk through unexpected authentication flow exposure.
SFTP authentication in GoAnywhere MFT prior to 7.10.0 allows remote unauthenticated attackers to bypass login attempt limits when targeting accounts configured with SSH key authentication, enabling brute force attacks against SSH private keys. The vulnerability affects the SFTP service specifically when Web Users are configured for SSH key-based login, exposing organizations to credential stuffing attacks. EPSS exploitation probability data not available; no evidence of active exploitation or public exploit code at time of analysis, though the attack vector is straightforward given network accessibility and low complexity (AV:N/AC:L/PR:N).
Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 use a static initialization vector (IV) for encryption, allowing authenticated administrative users to brute-force decryption of encrypted data. The vulnerability requires high-privilege access and computational effort but results in complete confidentiality loss of encrypted values. No public exploit code or active exploitation has been confirmed at time of analysis.
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.