Quentin Liddell

**Name of the Vulnerable Software and Affected Versions** Control-M/Server versions 9.0.20.x and earlier Control-M/Enterprise Manager versions 9.0.20.x and earlier **Description** Messaging consumer functionality allows unsafe deserialization of user-controlled data without sufficient restriction of allowed object types. This may enable an authenticated attacker to trigger unintended server-side behavior by providing crafted serialized content. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that can be used by a program. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Control-M/Server versions 9.0.20.x through 9.0.21.200 **Description** A communication command fails to sufficiently filter or sanitize user-supplied input. This flaw allows an unauthenticated attacker to execute unauthorized commands on the server, which could lead to a full system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Control-M/Enterprise Manager versions 9.0.20.x and earlier **Description** Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords. This flaw could allow an attacker who has obtained credential data to perform offline password recovery attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An issue exists where resources are allocated without limits or throttling, which allows for flooding. Flooding is a condition where a system is overwhelmed by a high volume of requests or data, potentially leading to a denial of service. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An issue exists where resources are allocated without limits or throttling, which allows for excessive allocation. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An uncontrolled memory allocation issue in Progress Software MOVEit Automation allows for excessive allocation. Uncontrolled memory allocation occurs when a program allocates more memory than is available or necessary, which can lead to system instability or crashes. **Recommendations** Update versions prior to 2025.0.11 to version 2025.0.11 or newer. Update versions 2025.1.0 through 2025.1.6 to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** Incorrect default permissions in the software allow for the retrieval of embedded sensitive data. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions 2025.1.0 through 2025.1.4 MOVEit Automation versions 2025.0.0 through 2025.0.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions prior to 2024.0.0 **Description** Improper input validation in Progress Software MOVEit Automation allows for privilege escalation. **Recommendations** Update versions 2025.1.0 through 2025.1.4 to 2025.1.5. Update versions 2025.0.0 through 2025.0.8 to 2025.0.9. Update versions 2024.0.0 through 2024.1.7 to 2024.1.8. Update versions prior to 2024.0.0 to 2024.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2024.1.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions 2025.0.0 through 2025.0.8 **Description** An improper authentication flaw allows attackers to bypass authentication entirely. This can lead to unauthorized administrative control, data exposure, privilege escalation, and lateral movement across enterprise networks. **Recommendations** Update versions prior to 2024.0.0 to version 2024.1.8 or later. Update versions 2024.0.0 through 2024.1.7 to version 2024.1.8 or later. Update versions 2025.0.0 through 2025.0.8 to version 2025.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions prior to build 41124 **Description** Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access or misuse of the stored credentials. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 41124 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions prior to build 40497 Acronis Cyber Protect 17 (Linux, macOS, Windows) versions prior to build 41186 **Description** Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 40497 or later. Update Acronis Cyber Protect 17 to build 41186 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** A flaw exists that allows for sensitive data disclosure and manipulation due to missing authorization checks. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent versions prior to build 39870 Acronis Cyber Protect 16 versions prior to build 39938 Acronis Cyber Protect 15 versions prior to build 41800 **Description** The software suffers from a flaw allowing sensitive data disclosure and manipulation because of a lack of authentication. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 39870 or later. Update Acronis Cyber Protect 16 to build 39938 or later. Update Acronis Cyber Protect 15 to build 41800 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions before build 40077 **Description** The issue is related to a denial of service caused by improper handling of malformed input. **Recommendations** For Acronis Cyber Protect Cloud Agent versions before build 40077, update to build 40077 or later to resolve the issue.