Advisories · Technology
Progress MOVEit Transfer.
Every CVE that names Progress MOVEit Transfer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
MOVEit Transfer Identity validation flaw in SFTP authentication
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 7.2 High
MOVEit Transfer SQL injection in custom reporting
- Progress MOVEit Transfer
- SQL injection
- CVSS 7.3 High
MOVEit Transfer Local Disclosure of Session Information Vulnerability
- Progress MOVEit Transfer
- Information disclosure
- CVSS 7.5 High
MOVEit Transfer Email MFA Bypass
- Progress MOVEit Transfer
- CWE-176
- CVSS 7.5 High
MOVEit Transfer Access restriction bypass in OAuth authentication
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 7.5 High
MOVEit Transfer Authorization Flaw in Certificate Management
- Progress MOVEit Transfer
- Broken access control
- CVSS 7.5 High
MOVEit Transfer LDAP injection in certificate-based authentication
- Progress MOVEit Transfer
- Other injection
- CVSS 7.5 High
MOVEit Transfer OIDC Authentication Replay Vulnerability
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 8.0 High
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
- Progress MOVEit Transfer
- Cross-site scripting (XSS)
- CVSS 8.1 High
MOVEit Transfer Authentication bypass in LDAP sign-on
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 8.8 High
MOVEit Transfer Secure Messaging Authentication Bypass
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 8.8 High
MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
- Progress MOVEit Transfer
- Broken access control
- CVSS 7.1 High
Stored XSS vulnerability in MOVEit Transfer
- Progress MOVEit Transfer
- Cross-site scripting (XSS)
- CVSS 7.5 High
MOVEit Transfer refresh-token processing does not enforce updated account restrictions
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 7.5 High
Improper CORS handling in MOVEit Transfer
- Progress MOVEit Transfer
- CWE-942
- CVSS 7.5 High
MFA Bypass in MOVEit Transfer
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 3.5 Low
File Extension Restriction Bypass in MOVEit Transfer
- Progress MOVEit Transfer
- CWE-46
- CVSS 2.7 Low
Cross-Org External Token Metadata accessible to AuditUser role
- Progress MOVEit Transfer
- Broken access control
- CVSS 3.7 Low
IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 4.5 Medium
Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
- Progress MOVEit Transfer
- Path traversal
- CVSS 6.4 Medium
Institution scope bypass vulnerability in custom reports
- Progress MOVEit Transfer
- Other injection
- CVSS 8.0 High
Stored XSS in MOVEit Transfer Ad Hoc module
- Progress MOVEit Transfer
- Cross-site scripting (XSS)
- CVSS 7.5 High
Memory leak in SFTP service can result in a denial of service in MOVEit Transfer
- Progress MOVEit Transfer
- Denial of service
- CVSS 7.2 High
Table scope bypass vulnerability in custom reports
- Progress MOVEit Transfer
- Other injection
- CVSS 3.7 Low
MOVEit Transfer REST API does not require current password in order to initiate the password change process
- Progress MOVEit Transfer
- CWE-620
- CVSS 5.3 Medium
External Service Interaction (DNS)
- Progress MOVEit Transfer
- Server-side request forgery (SSRF)
- CVSS 8.2 High
AS2 module allows uncontrolled file uploads
- Progress MOVEit Transfer
- Denial of service
- CVSS 5.9 Medium
A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
- Progress MOVEit Transfer
- Privilege escalation
- CVSS 7.3 High
MOVEit Transfer Privilege Escalation Vulnerability
- Progress MOVEit Transfer
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
MOVEit Transfer Authentication Bypass Vulnerability
- Progress MOVEit Transfer
- Authentication bypass