Buffer overflow

Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name...

CVE-2020-28864

CVE-2020-28864 describes a buffer overflow in WinSCP 5.17.8 triggered by a long filename from a malicious FTP server. The issue can cause a denial of service and may have other unspecified impacts. Multiple sources (NVD entry) confirm the affected product and vulnerability class; the precise root...

CVE-2020-28864

Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name...

Amazon Linux AMI : squid (ALAS-2020-1453)

The version of squid installed on the remote host is prior to 3.5.20-17.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1453 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive...

Informatica: Blind SQL injection at tsftp.informatica.com

The parameter refreshtoken sent to the REST path /api/v1/token is vulnerable to blind SQL injection. Compare the response time of these 2 requests: $ time curl -X POST "https://tsftp.informatica.com/api/v1/token" -H "accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -...

Mail.ru: [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write

CVE-2015-3306 in opened to external network FTP server on files.ucs.ru...

Oracle Linux 7 : squid (ELSA-2020-4082)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4082 advisory. - Resolves: 1872349 - CVE-2020-24606 squid: Improper Input Validation could result in a DoS - Resolves: 1872327 - CVE-2020-15810 squid: HTTP Request...

CVE-2017-10355

It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2020-2127)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling o...

USN-4515-1: Pure-FTPd vulnerability

Antonio Norales discovered that Pure-FTPd incorrectly handled directory aliases. An attacker could possibly use this issue to access sensitive information. CVE-2020-9274...

FreeBSD-SA-20:30.ftpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory The FreeBSD Project Topic: ftpd privilege escalation via ftpchroot feature Category: core Module: ftpd Announced: 2020-09-15...

ProFTPD: Denial of service

Background ProFTPD is an advanced and very configurable FTP server. Description It was found that ProFTPD did not properly handle invalid SCP commands. Impact An authenticated remote attacker could issue invalid SCP commands, possibly resulting in a Denial of Service condition. Workaround There i...

Amazon Linux 2 : squid (ALAS-2020-1486)

The version of squid installed on the remote host is prior to 3.5.20-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1486 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive informatio...

Medium: squid

Issue Overview: An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. CVE-2019-12528 This vulnerability allows remote attackers...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1884)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does...

Server-Side Request Forgery (SSRF)

ftp-srv is vulnerable to server-side request forgery. A remote client is able to submit requests on behalf of the server and access resources within the internal network accessible by the server, including private resources in the hosting environment...

Server side request forgery (ssrf)

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a...

USN-4458-1: Apache HTTP Server vulnerabilities

Fabrice Perez discovered that the Apache modrewrite module incorrectly handled certain redirects. A remote attacker could possibly use this issue to perform redirects to an unexpected URL. CVE-2020-1927 Chamal De Silva discovered that the Apache modproxyftp module incorrectly handled memory when...

Information Disclosure

Squid is vulnerable to information disclosure. An issue was discovered in Squid allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes...

QlikView 12.50.20000.0 Denial Of Service

Exploit Title: QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service PoC Discovery by: Luis Martinez Discovery Date: 2020-08-03 Vendor Homepage: https://www.qlik.com Software Link: https://www.qlik.com/us/trial/qlik-sense-business Tested Version: 12.50.20000.0 Vulnerability Type: Denial...