Ipswitch MOVEit Mobile vulnerabilities

3 CVEs affecting Ipswitch MOVEit Mobile, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-7679, published 2016-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7675, published 2016-02-10. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID…
CVE-2015-7679, published 2016-02-10. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/.
CVE-2015-7678, published 2016-02-10. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown…