Progress / Moveit Transfer
37 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-15968 | Stored XSS vulnerability in MOVEit Transfer | HIGH | 7.1 | Jul 23, 2026 |
| CVE-2026-15967 | MOVEit Transfer refresh-token processing does not enforce updated account restrictions | CRITICAL | 9.8 | Jul 23, 2026 |
| CVE-2026-15966 | Improper CORS handling in MOVEit Transfer | CRITICAL | 9.8 | Jul 23, 2026 |
| CVE-2026-10697 | MFA Bypass in MOVEit Transfer | CRITICAL | 9.8 | Jul 23, 2026 |
| CVE-2026-8801 | File Extension Restriction Bypass in MOVEit Transfer | CRITICAL | 9.8 | Jul 8, 2026 |
| CVE-2026-8800 | Cross-Org External Token Metadata accessible to AuditUser role | HIGH | 8.8 | Jul 8, 2026 |
| CVE-2026-8651 | IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-8650 | Authenticated Path Traversal allows MOVEit admins to view arbitrary system files | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-8649 | Institution scope bypass vulnerability in custom reports | CRITICAL | 9.8 | Jul 8, 2026 |
| CVE-2026-11903 | Stored XSS in MOVEit Transfer Ad Hoc module | HIGH | 8.0 | Jul 8, 2026 |
| CVE-2026-10699 | Memory leak in SFTP service can result in a denial of service in MOVEit Transfer | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-10698 | Table scope bypass vulnerability in custom reports | HIGH | 7.2 | Jul 8, 2026 |
| CVE-2025-11235 | MOVEit Transfer REST API does not require current password in order to initiate the password change process | HIGH | 7.5 | Jan 6, 2026 |
| CVE-2025-13147 | External Service Interaction (DNS) | MEDIUM | 5.3 | Nov 19, 2025 |
| CVE-2025-10932 | AS2 module allows uncontrolled file uploads | HIGH | 8.2 | Oct 29, 2025 |
| CVE-2025-2324 | A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder | HIGH | 8.8 | Mar 19, 2025 |
| CVE-2024-6576 | MOVEit Transfer Privilege Escalation Vulnerability | CRITICAL | 9.8 | Jul 29, 2024 |
| CVE-2024-5806 | MOVEit Transfer Authentication Bypass Vulnerability | CRITICAL | 9.8 | Jun 25, 2024 |
| CVE-2024-2291 | MOVEit Transfer Logging Bypass Vulnerability | MEDIUM | 4.3 | Mar 20, 2024 |
| CVE-2024-0396 | Missing Server-Side Input Validation in HTTP Parameter | HIGH | 7.1 | Jan 17, 2024 |
| CVE-2023-6218 | MOVEit Transfer Group Admin Privilege Escalation | HIGH | 7.2 | Nov 29, 2023 |
| CVE-2023-6217 | MOVEit Transfer XSS via MOVEit Gateway | HIGH | 7.1 | Nov 29, 2023 |
| CVE-2023-42656 | MOVEit Transfer Reflected XSS | MEDIUM | 6.1 | Sep 20, 2023 |
| CVE-2023-40043 | MOVEit Transfer System Administrator SQL Injection | HIGH | 7.2 | Sep 20, 2023 |
| CVE-2023-42660 | MOVEit Transfer Machine Interface SQL Injection | HIGH | 8.8 | Sep 20, 2023 |
Showing 1 to 25 of 37 CVEs