https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-18465.htmlhttps://patchthecve.com/cve/CVE-2019-18465.htmlWed, 17 Jun 2026 02:25:04 +0000CRITICAL 9.8: In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.https://patchthecve.com/cve/CVE-2019-18464.htmlhttps://patchthecve.com/cve/CVE-2019-18464.htmlWed, 17 Jun 2026 02:25:04 +0000CRITICAL 9.8: In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on thehttps://patchthecve.com/cve/CVE-2019-16383.htmlhttps://patchthecve.com/cve/CVE-2019-16383.htmlWed, 17 Jun 2026 02:22:12 +0000CRITICAL 9.4: MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker https://patchthecve.com/cve/CVE-2019-12146.htmlhttps://patchthecve.com/cve/CVE-2019-12146.htmlWed, 17 Jun 2026 02:14:08 +0000CRITICAL 9.1: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.https://patchthecve.com/cve/CVE-2019-12145.htmlhttps://patchthecve.com/cve/CVE-2019-12145.htmlWed, 17 Jun 2026 02:14:08 +0000HIGH 7.5: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system.https://patchthecve.com/cve/CVE-2019-12144.htmlhttps://patchthecve.com/cve/CVE-2019-12144.htmlWed, 17 Jun 2026 02:14:08 +0000CRITICAL 9.8: An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the https://patchthecve.com/cve/CVE-2018-6545.htmlhttps://patchthecve.com/cve/CVE-2018-6545.htmlWed, 17 Jun 2026 02:02:00 +0000MEDIUM 6.1: Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks.https://patchthecve.com/cve/CVE-2017-16513.htmlhttps://patchthecve.com/cve/CVE-2017-16513.htmlWed, 17 Jun 2026 01:09:22 +0000HIGH 7.8: Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729.https://patchthecve.com/cve/CVE-2017-12639.htmlhttps://patchthecve.com/cve/CVE-2017-12639.htmlWed, 17 Jun 2026 01:03:43 +0000CRITICAL 9.8: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETRE or ETCTERARED.https://patchthecve.com/cve/CVE-2017-12638.htmlhttps://patchthecve.com/cve/CVE-2017-12638.htmlWed, 17 Jun 2026 01:03:43 +0000CRITICAL 9.8: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETBL or ETCETERABLUE.https://patchthecve.com/cve/CVE-2017-6195.htmlhttps://patchthecve.com/cve/CVE-2017-6195.htmlWed, 17 Jun 2026 01:21:55 +0000CRITICAL 9.8: Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20.