CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...

CVE-2017-8304

An issue was discovered on Accellion FTA devices before FTA912180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI...

CVE-2017-8796

An issue was discovered on Accellion FTA devices before FTA912180. Because mysqlrealescapestring is misused, seos/courier/communicationp2p.php allows SQL injection with the appid parameter...

CVE-2017-8303

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

CVE-2017-8791

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

Crlf injection

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

Security feature bypass

An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...

Remote code execution

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

Sql injection

An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...

Server side request forgery (ssrf)

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

CVE-2017-8790

An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI...

CVE-2017-8789

Accellion FTA devices prior to FTA_9_12_180 are affected by a SQL injection in the report_error.php?year parameter. The issue allows a remote attacker to potentially execute arbitrary SQL commands against the backend database. Root cause is an injectable SQL vector in report_error.php, exposing c...

CVE-2017-8788

CVE-2017-8788 affects Accellion FTA devices prior to FTA_9_12_180. A CRLF injection vulnerability exists in settings_global_text_edit.php that enables newline/CRLF payloads (e.g., ?display=x%0Dnewline) and, per CNVD/NVD records, can allow remote command execution. Impact details in the connected ...

CVE-2017-8793

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...