Airbus Seclab

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** Incorrect default permissions in the software allow for the retrieval of embedded sensitive data. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An issue exists where resources are allocated without limits or throttling, which allows for flooding. Flooding is a condition where a system is overwhelmed by a high volume of requests or data, potentially leading to a denial of service. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An uncontrolled memory allocation issue in Progress Software MOVEit Automation allows for excessive allocation. Uncontrolled memory allocation occurs when a program allocates more memory than is available or necessary, which can lead to system instability or crashes. **Recommendations** Update versions prior to 2025.0.11 to version 2025.0.11 or newer. Update versions 2025.1.0 through 2025.1.6 to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2025.0.11 MOVEit Automation versions 2025.1.0 through 2025.1.6 **Description** An issue exists where resources are allocated without limits or throttling, which allows for excessive allocation. **Recommendations** Update to version 2025.0.11 or newer. Update to version 2025.1.7 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions 2025.1.0 through 2025.1.4 MOVEit Automation versions 2025.0.0 through 2025.0.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions prior to 2024.0.0 **Description** Improper input validation in Progress Software MOVEit Automation allows for privilege escalation. **Recommendations** Update versions 2025.1.0 through 2025.1.4 to 2025.1.5. Update versions 2025.0.0 through 2025.0.8 to 2025.0.9. Update versions 2024.0.0 through 2024.1.7 to 2024.1.8. Update versions prior to 2024.0.0 to 2024.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** MOVEit Automation versions prior to 2024.1.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions 2025.0.0 through 2025.0.8 **Description** An improper authentication flaw allows attackers to bypass authentication entirely. This can lead to unauthorized administrative control, data exposure, privilege escalation, and lateral movement across enterprise networks. **Recommendations** Update versions prior to 2024.0.0 to version 2024.1.8 or later. Update versions 2024.0.0 through 2024.1.7 to version 2024.1.8 or later. Update versions 2025.0.0 through 2025.0.8 to version 2025.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions prior to build 40497 Acronis Cyber Protect 17 (Linux, macOS, Windows) versions prior to build 41186 **Description** Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 40497 or later. Update Acronis Cyber Protect 17 to build 41186 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions prior to build 41124 **Description** Credentials are not deleted from the Acronis Agent after plan revocation. This can potentially lead to unauthorized access or misuse of the stored credentials. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 41124 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** A flaw exists that allows for sensitive data disclosure and manipulation due to missing authorization checks. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 **Description** The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and manipulation. **Recommendations** Update Acronis Cyber Protect 15 to build 41800 or later. Update Acronis Cyber Protect 16 to build 39938 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent versions prior to build 39870 Acronis Cyber Protect 16 versions prior to build 39938 Acronis Cyber Protect 15 versions prior to build 41800 **Description** The software suffers from a flaw allowing sensitive data disclosure and manipulation because of a lack of authentication. **Recommendations** Update Acronis Cyber Protect Cloud Agent to build 39870 or later. Update Acronis Cyber Protect 16 to build 39938 or later. Update Acronis Cyber Protect 15 to build 41800 or later.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions before build 40077 **Description** The issue is related to a denial of service caused by improper handling of malformed input. **Recommendations** For Acronis Cyber Protect Cloud Agent versions before build 40077, update to build 40077 or later to resolve the issue.