TI-2026-20908 CVE-2026-25866 · GHSA-5483-8h5w-c2hp
MobaXterm < 26.1 Notepad++ Unquoted Service Path
Priority LOW 38
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability.
Vulnerabilities
10 records
TI-2022-17980 CVE-2022-38337 · GHSA-r647-g7f3-cxvq
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the…
Priority MEDIUM 49
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server.
TI-2022-17979 CVE-2022-38336 · GHSA-xhw8-cw4m-2j3c
An access control issue in MobaXterm before v22.1 allows attackers to make connections to…
Priority HIGH 70
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.
TI-2021-09836 CVE-2021-28847 · GHSA-whgp-9qjc-434f
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI…
Priority LOW 36
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW cal…
TI-2019-12274 CVE-2019-16305 · GHSA-pg54-ccpq-c42c
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.
Priority MEDIUM 48
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.
TI-2019-10117 CVE-2019-13475 · GHSA-qhg9-fcxx-72fv
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability…
Priority MEDIUM 45
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL.
TI-2019-05419 CVE-2019-7690 · GHSA-7w57-wp3w-8gq9
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its…
Priority MEDIUM 48
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH serve…
TI-2017-11289 CVE-2017-15376 · GHSA-p8fh-j448-7454
The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which…
Priority MEDIUM 49
The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23.
TI-2017-04557 CVE-2017-6805 · GHSA-rrc9-3j3x-vfxh
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4…
Priority LOW 35
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a ..
TI-2015-06016 CVE-2015-7244 · GHSA-v6qx-v2fm-22f6
The default configuration of the server in MobaXterm before 8.3 has a disabled Access…
Priority MEDIUM 41
The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitra…