Ipswitch MOVEit Transfer vulnerabilities

3 CVEs affecting Ipswitch MOVEit Transfer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-18465, published 2019-10-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16383, published 2019-09-24. Critical severity, CVSS 9.4. EPSS: 5.2% chance of exploitation in the next 30 days. MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database.…
CVE-2019-18464, published 2019-10-31. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that…
CVE-2019-18465, published 2019-10-31. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects…