CVE-2017-8791

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

CVE-2017-8795

Summary of CVE-2017-8795 (Accellion FTA) : A cross-site scripting (XSS) flaw exists in Accellion FTA devices before FTA_9_12_180, specifically in the page home/seos/courier/smtpg_add.html where the parameter is unsafely reflected. This affects Accellion FTA devices prior to the cited version; the...

CVE-2017-8794

Vulnerability: Accellion FTA devices prior to FTA_9_12_180 are affected by CVE-2017-8794. Root cause: a regular expression intended to match local https URLs lacks the initial ^, allowing SSRF via courier/web/1000@/wmProgressval.html with crafted file:///etc/passwd#https:// URLs. Impact: server-s...

CVE-2017-8793

CVE-2017-8793 affects Accellion FTA devices prior to FTA_9_12_180. A POST to home/seos/courier/web/wmProgressstat.html.php with an attacker-controlled acallow parameter can trigger an Access-Control-Allow-Origin header, bypassing Same-Origin Policy and granting the attacker site access. Severity ...

CVE-2017-8791

CVE-2017-8791 affects Accellion FTA devices prior to FTA_9_12_180. The vulnerability is a CRLF injection in the login page parameter path: home/seos/courier/login.html auth_params, allowing a remote attacker to trigger a CRLF-based attack. Public sources in CNVD/NVD confirm a remote-exploitation ...

CVE-2017-8790

An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

CVE-2017-8789

An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...

CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

CVE-2017-8790

Summary: CVE-2017-8790 concerns the Accellion FTA line prior to version FTA_9_12_180. The vulnerability is a LDAP Injection in the web interface, specifically the POST parameter filter in the path home/seos/courier/ldaptest.html. The root cause is improper handling of LDAP queries, allowing a rem...

CVE-2017-8760

CVE-2017-8760: An XSS vulnerability affecting Accellion FTA devices prior to FTA_9_12_180. The flaw resides in the courier/1000@/index.html page via the auth_params parameter, with the device’s internal WAF filters unable to reliably block certain payloads; bypasses via URL-encoding and similar m...

CVE-2017-8760

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...

CVE-2017-8796

CVE-2017-8796 affects Accellion FTA devices prior to FTA_9_12_180. The issue is a misuse of mysql_real_escape_string in seos/courier/communication_p2p.php, enabling SQL injection via the app_id parameter. Impact is high: potential for unauthorized data access/manipulation; CVSS v3.0 base score 9....

CVE-2017-8792

The CVE-2017-8792 entry concerns Accellion FTA devices prior to FTA_9_12_180 with a Cross‑Site Scripting (XSS) flaw in the web page path home/seos/courier/user_add.html, exploitable via the parameter field. The connected documents consistently describe the vulnerability as XSS; no exploit details...

CVE-2017-8304

Accellion FTA devices prior to FTA_9_12_180 are affected by a cross-site scripting vulnerability in courier/1000@/oauth/playground/callback.html triggered by a crafted URI. CNVD/NVD entries corroborate a via-URL XSS in the Accellion FTA web UI, listed as CVE-2017-8304. The provided documents do n...

CVE-2017-8303

Summary : CVE-2017-8303 affects Accellion FTA devices prior to FTA_9_12_180. The connected CNVD/PRION/CVE records corroborate a vulnerability in seos/1000/find.api that enables Remote Code Execution via shell metacharacters in the method parameter. The core detail across sources is the affected s...

CVE-2017-8796

An issue was discovered on Accellion FTA devices before FTA912180. Because mysqlrealescapestring is misused, seos/courier/communicationp2p.php allows SQL injection with the appid parameter...

CVE-2017-8303

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

CVE-2017-8788

An issue was discovered on Accellion FTA devices before FTA912180. There is a CRLF vulnerability in settingsglobaltextedit.php allowing ?display=x%0Dnewline attacks...

CVE-2017-8794

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...