CVE-2016-2350

CVE-2016-2350 refers to multiple XSS vulnerabilities in Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40. The affected components are getimageajax.php, move_partition_frame.html, and wmInfo.html, which can be exploited by supplying input that results in arbitrary web script or HTML ex...

CVE-2016-2351

CVE-2016-2351 affects the Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40. The vulnerability is an SQL injection in the file path home/seos/courier/security_key2.api that allows a remote attacker to execute arbitrary SQL commands via the client_id parameter, as documented by NVD and ...

CVE-2016-2351

SQL injection vulnerability in home/seos/courier/securitykey2.api on the Accellion File Transfer Appliance FTA before FTA91240 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2016-2350

Multiple cross-site scripting XSS vulnerabilities on the Accellion File Transfer Appliance FTA before FTA91240 allow remote attackers to inject arbitrary web script or HTML via unspecified input to 1 getimageajax.php, 2 movepartitionframe.html, or 3 wmInfo.html...

CVE-2016-2352

The Accellion File Transfer Appliance FTA before FTA91240 allows remote authenticated users to execute arbitrary commands by leveraging the YUMCLIENT restricted-user role...

CVE-2016-2353

The connected OpenVAS entry identifies multiple vulnerabilities in Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40, including local privilege escalation by allowing a local user to add an SSH key to an arbitrary group, enabling privilege gain. The CVE-2016-2353 entry likewise describ...

CVE-2016-2352

The CVE-2016-2352 entry concerns the Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40. The vulnerability arises from the YUM_CLIENT restricted-user role, enabling remote authenticated users to execute arbitrary commands with elevated privileges. Public documentation across sources con...

CVE-2016-2353

The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...

Accellion File Transfer Appliance (FTA) contains multiple vulnerabilities

Overview The Accellion File Transfer Appliance FTA contains multiple vulnerabilites that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Accellion File Transfer appliance contains multiple vulnerabilities in versions below...

Accellion FTA RCE Vulnerability

Accellion FTA is prone to a remote command execution RCE vulnerability SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Accellion File Transfer Appliance (FTA) Detection (HTTP)

HTTP based detection of a Accellion File Transfer Appliance FTA SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Accellion FTA < 9.11.200 File Disclosure Vulnerability - Active Check

Accellion FTA is prone to a file disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Accellion Secure File Transfer Appliance 'oauth_token' Parameter Remote Command Execution

The remote Accellion Secure File Transfer Appliance is affected by a remote command execution vulnerability due to improper sanitization of user-supplied in put to the 'oauthtoken' parameter in the getoauthcustomername and verifyoauthtoken functions. The parameter is passed to a system command...

Accellion Secure File Transfer Appliance Detection

Binary data accellionfiletransferappliancedetect.nbin...

Accellion Secure File Transfer Appliance 'statecode' Cookie Remote File Disclosure

The remote Accellion Secure File Transfer Appliance is affected by an arbitrary file disclosure vulnerability due to improper sanitization of user-supplied input to the 'statecode' cookie used by the template function in function.inc. A remote, unauthenticated attacker can exploit this...

Accellion FTA getStatus command injection

Added: 07/16/2015 CVE: CVE-2015-2857 Background The Accellion File Transfer Appliance is a solution for secure file sharing. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands contained in the oauthtoken parameter to the getStatus action. Resolution...

Accellion FTA getStatus command injection

Added: 07/16/2015 CVE: CVE-2015-2857 Background The Accellion File Transfer Appliance is a solution for secure file sharing. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands contained in the oauthtoken parameter to the getStatus action. Resolution...

Accellion FTA getStatus command injection

Added: 07/16/2015 CVE: CVE-2015-2857 Background The Accellion File Transfer Appliance is a solution for secure file sharing. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands contained in the oauthtoken parameter to the getStatus action. Resolution...

Accellion FTA getStatus command injection

Added: 07/16/2015 CVE: CVE-2015-2857 Background The Accellion File Transfer Appliance is a solution for secure file sharing. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands contained in the oauthtoken parameter to the getStatus action. Resolution...

Accellion File Transfer appliance getStatus verify_oauth_token Command Execution Exploit

This Metasploit module exploits a metacharacter shell injection vulnerability in the Accellion File Transfer appliance. This vulnerability is triggered when a user-provided 'oauthtoken' is passed into a system call within a modperl handler. This Metasploit module exploits the '/tws/getStatus'...