Filtered by vendor Fortra Subscriptions
Total 28 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-14362 1 Fortra 2 Goanywhere Managed File Transfer, Goanywhere Mft 2026-04-23 7.3 High
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
CVE-2025-1241 4 Apple, Fortra, Linux and 1 more 6 Macos, Goanywhere Agents, Goanywhere Managed File Transfer and 3 more 2026-04-23 5.8 Medium
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
CVE-2026-0971 1 Fortra 2 Goanywhere Managed File Transfer, Goanywhere Mft 2026-04-23 4.3 Medium
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
CVE-2026-0972 1 Fortra 2 Goanywhere Managed File Transfer, Goanywhere Mft 2026-04-23 5.4 Medium
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.
CVE-2026-1089 1 Fortra 2 Goanywhere Managed File Transfer, Goanywhere Mft 2026-04-23 6.5 Medium
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
CVE-2024-4332 1 Fortra 1 Tripwire Enterprise 2026-04-15 N/A
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.
CVE-2024-5275 1 Fortra 2 Filecatalyst Direct, Filecatalyst Workflow 2026-04-15 7.8 High
A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middle (MiTM) attack against users of the agent. This issue affects all versions of FileCatalyst Direct from 3.8.10 Build 138 and earlier and all versions of FileCatalyst Workflow from 5.1.6 Build 130 and earlier.
CVE-2024-3334 1 Fortra 1 Digital Guardian Agent 2026-04-15 4.3 Medium
A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data.
CVE-2025-8450 1 Fortra 2 Filecatalyst Direct, Filecatalyst Workflow 2026-04-15 8.2 High
Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
CVE-2025-13532 1 Fortra 1 Boks 2026-04-15 6.2 Medium
Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.  This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
CVE-2025-10035 1 Fortra 1 Goanywhere Managed File Transfer 2026-02-26 10 Critical
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVE-2025-8148 1 Fortra 1 Goanywhere Managed File Transfer 2026-01-30 4.2 Medium
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
CVE-2023-0669 1 Fortra 1 Goanywhere Managed File Transfer 2025-11-03 7.2 High
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CVE-2024-25153 1 Fortra 2 Filecatalyst, Filecatalyst Workflow 2025-09-19 9.8 Critical
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.
CVE-2024-6633 1 Fortra 1 Filecatalyst Workflow 2025-08-30 9.8 Critical
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB.
CVE-2024-0204 1 Fortra 1 Goanywhere Managed File Transfer 2025-05-30 9.8 Critical
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
CVE-2024-11922 1 Fortra 1 Goanywhere Managed File Transfer 2025-05-10 6.3 Medium
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
CVE-2025-0049 1 Fortra 1 Goanywhere Managed File Transfer 2025-05-10 3.5 Low
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.
CVE-2024-0259 2 Fortra, Microsoft 2 Robot Schedule, Windows 2025-04-09 7.3 High
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.
CVE-2024-5276 1 Fortra 1 Filecatalyst Workflow 2025-04-05 9.8 Critical
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.