CVE-2021-37425

Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.

• CWE-611

• http://seclists.org/fulldisclosure/2021/Aug/12Exploit, Mailing List, Third Party Advisory
• https://www.altova.com/mobiletogetherVendor Advisory
• https://www.redteam-pentesting.de/advisories/rt-sa-2021-002Exploit, Third Party Advisory
• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Aug/12Exploit, Mailing List, Third Party Advisory
• https://www.altova.com/mobiletogetherVendor Advisory
• https://www.redteam-pentesting.de/advisories/rt-sa-2021-002Exploit, Third Party Advisory
• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory

Published

Aug 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3742A Server-Side Request Forgery (SSRF) vulnerability was disco…8.8
• CVE-2021-37420Zoho ManageEngine ADSelfService Plus before 6112 is vulnerab…6.5
• CVE-2021-37421Zoho ManageEngine ADSelfService Plus 6103 and prior is vulne…9.8
• CVE-2021-37422Zoho ManageEngine ADSelfService Plus 6111 and prior is vulne…9.8
• CVE-2021-37423Zoho ManageEngine ADSelfService Plus 6111 and prior is vulne…9.8
• CVE-2021-37424ManageEngine ADSelfService Plus before 6112 is vulnerable to…9.8
• CVE-2021-3743An out-of-bounds (OOB) memory read flaw was found in the Qua…7.1
• CVE-2021-37436Amazon Echo Dot devices through 2021-07-02 sometimes allow a…4.2
• CVE-2021-37438Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-37439NCH FlexiServer v6.00 suffers from a syslog?file=/.. path tr…6.5
• CVE-2021-3744A memory leak flaw was found in the Linux kernel in the ccp_…5.5
• CVE-2021-37440NCH Axon PBX v2.22 and earlier allows path traversal for fil…6.5