CVE-2009-4646

Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string...

CVE-2009-4648

Accellion Secure File Transfer Appliance before 80105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via 1 arbitrary arguments in the --filemove action in /usr/local/bin/admin.pl, or a...

Command injection

Accellion Secure File Transfer Appliance before 80105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via 1 arbitrary arguments in the --filemove action in /usr/local/bin/admin.pl, or a...

CVE-2009-4644

Accellion Secure File Transfer Appliance before 80105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program...

Cross site scripting

Cross-site scripting XSS vulnerability in Accellion Secure File Transfer Appliance before 70296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs...

Code injection

Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string...

CVE-2009-4646

CVE-2009-4646 affects the Accellion Secure File Transfer Appliance. The available connected records describe a static code injection vulnerability in the appliance’s administrative web interface that allows remote authenticated administrators to inject arbitrary shell commands by appending them t...

CVE-2009-4647

Cross-site scripting XSS vulnerability in Accellion Secure File Transfer Appliance before 70296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs...

CVE-2009-4647

Affected product: Accellion Secure File Transfer Appliance. Vulnerability: Cross-site scripting (XSS) via the username parameter when the administrator views audit logs. Impact: remote attacker can inject arbitrary web script/HTML into the admin context. Root cause: improper handling of the usern...

CVE-2009-4648

CVE-2009-4648 affects Accellion Secure File Transfer Appliance before 8_0_105. Root cause: access to sensitive commands run with extra sudo privileges is not properly restricted in /usr/local/bin/admin.pl, enabling local administrators to escalate privileges. Vulnerability vectors include (1) arb...

CVE-2009-4646

Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string...

CVE-2009-4645

Directory traversal vulnerability in webclientuserguide.html in Accellion Secure File Transfer Appliance before 80105 allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...

CVE-2009-4644

Accellion Secure File Transfer Appliance before 80105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program...

CVE-2009-4645

CVE-2009-4645 affects Accellion Secure File Transfer Appliance (SFTA) before version 8_0_105. The issue is a directory traversal in web_client_user_guide.html triggered by a .. (dot dot) in the lang parameter, allowing remote attackers to read arbitrary files. The connected documents confirm the ...

CVE-2009-4644

The CVE-2009-4644 issue affects the Accellion Secure File Transfer Appliance, specifically versions prior to 8_0_105. It allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands by injecting shell metacharacters via the cli program (demonstrated wit...

CVE-2009-4648

Accellion Secure File Transfer Appliance before 80105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via 1 arbitrary arguments in the --filemove action in /usr/local/bin/admin.pl, or a...

Accellion File Transfer - Appliance web_client_user_guide.html?lang Traversal Arbitrary File Access

Accellion File Transfer - Appliance webclientuserguide.html?lang Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A...

Accellion Secure File Transfer Appliance - Multiple Command Restriction / Privilege Escalations

source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A directory-traversal issue - An HTML-injection issue - A remote command-injection issue An attacker may leverage...

Accellion Secure File Transfer Appliance - Multiple Command Restriction Privilege Escalations

Accellion Secure File Transfer Appliance - Multiple Command Restriction Privilege Escalations source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A directory-travers...

Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/38176/info Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including: - Multiple privilege-escalation issues - A directory-traversal issue - An HTML-injection issue - A remote command-injection issue An attacker may leverage...