Quentin Liddell

Local privilege escalation occurs due to improper authentication.

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

A communication command fails to sufficiently filter or sanitize user-supplied input. This flaw allows an unauthenticated attacker to execute unauthorized commands on the server, which could lead to a full system compromise.

Messaging consumer functionality allows unsafe deserialization of user-controlled data without sufficient restriction of allowed object types. This may enable an authenticated attacker to trigger unintended server-side behavior by providing crafted serialized content. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that can be used by a program.

Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords. This flaw could allow an attacker who has obtained credential data to perform offline password recovery attacks.

An issue exists where resources are allocated without limits or throttling, which allows for flooding. Flooding is a condition where a system is overwhelmed by a high volume of requests or data, potentially leading to a denial of service.

An issue exists where resources are allocated without limits or throttling, which allows for excessive allocation.

Incorrect default permissions in the software allow for the retrieval of embedded sensitive data.

An uncontrolled memory allocation issue in Progress Software MOVEit Automation allows for excessive allocation. Uncontrolled memory allocation occurs when a program allocates more memory than is available or necessary, which can lead to system instability or crashes.

An improper authentication flaw allows attackers to bypass authentication entirely. This can lead to unauthorized administrative control, data exposure, privilege escalation, and lateral movement across enterprise networks.

Improper input validation in Progress Software MOVEit Automation allows for privilege escalation.

Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access or misuse of the stored credentials.

Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access.

A flaw exists that allows for sensitive data disclosure and manipulation due to missing authorization checks.

The software suffers from a flaw allowing sensitive data disclosure and manipulation because of a lack of authentication.

The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation.

The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation.

The issue is related to a denial of service caused by improper handling of malformed input.