Mobatek records
11 published records for vendor mobatek.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 4
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-255 Credentials Management Errors1
- CWE-284 Improper Access Control1
- CWE-287 Improper Authentication1
- CWE-428 Unquoted Search Path or Element1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
11 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2017-15376No exploit | The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands vimobatek · mobaxterm · CWE-94 | Critical9.8 | — | 3.8% | Oct 16, 2017 |
40Plan | CVE-2019-7690No exploit | In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the limobatek · mobaxterm · CWE-255 | Critical9.8 | — | 3.2% | May 13, 2019 |
37Monitor | CVE-2019-16305No exploit | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.mobatek · mobaxterm · CWE-77 | High8.8 | — | 6.7% | Sep 14, 2019 |
36Monitor | CVE-2019-13475No exploit | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commmobatek · mobaxterm · CWE-88 | High8.8 | — | 4.1% | Jul 9, 2019 |
36Monitor | CVE-2022-38337No exploit | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server.mobatek · mobaxterm · CWE-798 | Critical9.1 | — | 0.8% | Dec 5, 2022 |
34Monitor | CVE-2026-25866No exploit | MobaXterm < 26.1 Notepad++ Unquoted Service Pathmobatek · mobaxterm · CWE-428 | High8.5 | — | 0.2% | Mar 9, 2026 |
33Monitor | CVE-2024-48200No exploit | An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte | High8.4 | — | 0.2% | Oct 31, 2024 |
32Monitor | CVE-2015-7244No exploit | The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authmobatek · mobaxterm · CWE-284 | High7.5 | — | 5.0% | Nov 3, 2015 |
32Monitor | CVE-2022-38336No exploit | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without amobatek · mobaxterm · CWE-287 | High8.1 | — | 0.9% | Dec 5, 2022 |
30Monitor | CVE-2021-28847No exploit | MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repemobatek · mobaxterm | High7.5 | — | 1.4% | Jun 3, 2021 |
23Monitor | CVE-2017-6805Proof of concept | Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via amobatek · mobaxterm · CWE-22 | Medium5.3 | — | 7.8% | Mar 20, 2017 |
- CVE-2017-1537640Plan
The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands vi
CriticalCVSS 9.8No exploitEPSS 4%mobatek · mobaxtermOct 16, 2017
- CVE-2019-769040Plan
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the li
CriticalCVSS 9.8No exploitEPSS 3%mobatek · mobaxtermMay 13, 2019
- CVE-2019-1630537Monitor
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.
HighCVSS 8.8No exploitEPSS 7%mobatek · mobaxtermSep 14, 2019
- CVE-2019-1347536Monitor
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary comm
HighCVSS 8.8No exploitEPSS 4%mobatek · mobaxtermJul 9, 2019
- CVE-2022-3833736Monitor
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server.
CriticalCVSS 9.1No exploitEPSS 1%mobatek · mobaxtermDec 5, 2022
- CVE-2026-2586634Monitor
MobaXterm < 26.1 Notepad++ Unquoted Service Path
HighCVSS 8.5No exploitEPSS 0%mobatek · mobaxtermMar 9, 2026
- CVE-2024-4820033Monitor
An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte
HighCVSS 8.4No exploitEPSS 0%Oct 31, 2024
- CVE-2015-724432Monitor
The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require auth
HighCVSS 7.5No exploitEPSS 5%mobatek · mobaxtermNov 3, 2015
- CVE-2022-3833632Monitor
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without a
HighCVSS 8.1No exploitEPSS 1%mobatek · mobaxtermDec 5, 2022
- CVE-2021-2884730Monitor
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repe
HighCVSS 7.5No exploitEPSS 1%mobatek · mobaxtermJun 3, 2021
- CVE-2017-680523Monitor
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a
MediumCVSS 5.3Proof of conceptEPSS 8%mobatek · mobaxtermMar 20, 2017