Goanywhere Mft
Approved changes feed: RSS · Atom
cpe:2.3:a:fortra:goanywhere_mft:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Fortra (f14f6bd1-8bf2-53f9-b0d6-b2745f517ba7) |
|---|---|
| Product | Goanywhere Mft (8a83f2b1-6c5d-552c-bcbe-580e52aad381) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1089 |
vulnerable | 2026-06-08 07:47:14.306363 |
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
MEDIUM (6.5)
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Published: 2026-04-21T14:14:58.244Z
Updated: 2026-04-21T15:00:35.492Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0972 |
vulnerable | 2026-06-08 07:47:13.566565 |
HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
MEDIUM (5.4)
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
Published: 2026-04-21T14:14:38.146Z
Updated: 2026-04-29T19:32:13.201Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0971 |
vulnerable | 2026-06-08 07:47:13.565118 |
GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
MEDIUM (4.3)
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Published: 2026-04-21T14:14:23.423Z
Updated: 2026-04-21T19:26:58.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8148 |
vulnerable | 2026-06-08 07:45:19.703001 |
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
MEDIUM (4.2)
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
Published: 2025-12-05T20:56:05.135Z
Updated: 2025-12-05T21:48:44.070Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3871 |
vulnerable | 2026-06-08 07:23:10.050306 |
Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier
MEDIUM (5.3)
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
Published: 2025-07-16T14:00:27.665Z
Updated: 2025-07-18T14:52:28.197Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1241 |
vulnerable | 2026-06-08 07:08:35.934553 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14362 |
vulnerable | 2026-06-08 07:06:34.355828 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10035 |
vulnerable | 2026-06-08 07:02:26.194423 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9945 |
vulnerable | 2026-06-08 07:00:28.955729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25157 |
vulnerable | 2026-06-08 06:31:22.547507 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25156 |
vulnerable | 2026-06-08 06:31:22.542491 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11922 |
vulnerable | 2026-06-08 06:23:50.673301 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0204 |
vulnerable | 2026-06-08 06:22:00.011476 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0669 |
vulnerable | 2026-06-08 05:52:32.239727 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.