Fortra

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-25155 1Fortra 1Filecatalyst Direct Jun 17, 2026 Mar 13, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which...Show more In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag. Show less
CVE-2024-25154 1Fortra 1Filecatalyst Direct Jun 17, 2026 Mar 13, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage....Show more Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage. Show less
CVE-2024-25153 1Fortra 1Filecatalyst Workflow Jun 17, 2026 Mar 13, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where...Show more A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.Show less
CVE-2024-0204 1Fortra 1Goanywhere Managed File Transfer Jun 17, 2026 Jan 22, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
CVE-2023-6253 1Fortra 1Digital Guardian Agent Jun 17, 2026 Nov 22, 2023 N/A· v4 6.0 MEDIUM· v3 N/A· v2 A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory o...Show more A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file.Show less
CVE-2021-26837 1Fortra 1Delivernow Jun 17, 2026 Sep 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information.
CVE-2023-0669 1Fortra 1Goanywhere Managed File Transfer Aug 6, 2026 Feb 6, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was...Show more Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.Show less

Previous 12