Ipswitch WhatsUp vulnerabilities

3 CVEs affecting Ipswitch WhatsUp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2006-2531, published 2006-05-22.

More from Ipswitch.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2005-1250, published 2005-06-22. High severity, CVSS 7.5. EPSS: 20.9% chance of exploitation in the next 30 days. SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the…
• CVE-2006-0911, published 2006-02-28. Medium severity, CVSS 5.0. EPSS: 16.3% chance of exploitation in the next 30 days. NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2)…
• CVE-2006-2531, published 2006-05-22. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by setting HTTP…