Goanywhere Managed File Transfer
Approved changes feed: RSS · Atom
cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Fortra (f14f6bd1-8bf2-53f9-b0d6-b2745f517ba7) |
|---|---|
| Product | Goanywhere Managed File Transfer (bc0776c9-0205-57ba-86a2-8bac65fc2c15) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1089 |
vulnerable | 2026-06-08 07:47:14.306407 |
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
MEDIUM (6.5)
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Published: 2026-04-21T14:14:58.244Z
Updated: 2026-04-21T15:00:35.492Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0972 |
vulnerable | 2026-06-08 07:47:13.566609 |
HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
MEDIUM (5.4)
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
Published: 2026-04-21T14:14:38.146Z
Updated: 2026-04-29T19:32:13.201Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0971 |
vulnerable | 2026-06-08 07:47:13.566211 |
GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
MEDIUM (4.3)
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Published: 2026-04-21T14:14:23.423Z
Updated: 2026-04-21T19:26:58.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8148 |
vulnerable | 2026-06-08 07:45:19.703838 |
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
MEDIUM (4.2)
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
Published: 2025-12-05T20:56:05.135Z
Updated: 2025-12-05T21:48:44.070Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1241 |
vulnerable | 2026-06-08 07:08:35.938113 |
Encryption vulnerable to brute-force decryption in GoAnywhere MFT
MEDIUM (5.8)
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
Published: 2026-04-21T14:10:09.505Z
Updated: 2026-04-21T19:33:03.005Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14362 |
vulnerable | 2026-06-08 07:06:34.356862 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10035 |
vulnerable | 2026-06-08 07:02:26.195105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0049 |
vulnerable | 2026-06-08 07:00:29.178146 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25157 |
vulnerable | 2026-06-08 06:31:22.547653 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25156 |
vulnerable | 2026-06-08 06:31:22.546040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11922 |
vulnerable | 2026-06-08 06:23:50.674126 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0204 |
vulnerable | 2026-06-08 06:22:00.012435 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0669 |
vulnerable | 2026-06-08 05:52:32.240516 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.