curl: FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled

Summary libcurl 8.22.0 sends values configured with CURLOPTFTPACCOUNT and CURLOPTFTPALTERNATIVETOUSER to a different origin reached through an HTTP-to-FTP redirect even when unrestricted authentication is disabled. I reproduced this after a successful legitimate FTP download by reusing the same...

spybrowse

BrowseSpy Asegúrate de cambiar las variables ftp en todo el código; estas variables contienen el nombre de usuario, la contraseña y la dirección IP del servidor FTP que recibe los archivos. Este código hará lo siguiente: 1. Se copiará a sí mismo en el directorio %TMP% y se nombrará ursakta.exe 2...

dotdotpwn

DESCRIZIONE DotDotPwn - Il Fuzzer per Directory Traversal È un fuzzer molto flessibile e intelligente per scoprire vulnerabilità di directory traversal in software come server HTTP/FTP/TFTP, piattaforme web come CMS, ERP, Blog, ecc. Inoltre, dispone di un modulo indipendente dal protocollo per...

OPENSUSE-SU-2026:22080-1 Security update for squid

This update for squid fixes the following issues: - CVE-2026-32748: denial of service in ICP Request handling bsc1260453. - CVE-2026-33515: out of bounds read in ICP message handling bsc1260454. - CVE-2026-33526: denial of service in ICP Request handling bsc1260452. - CVE-2026-47729: out-of-bound...

SUSE-SU-2026:24224-1 Security update for squid

This update for squid fixes the following issues: - CVE-2026-32748: denial of service in ICP Request handling bsc1260453. - CVE-2026-33515: out of bounds read in ICP message handling bsc1260454. - CVE-2026-33526: denial of service in ICP Request handling bsc1260452. - CVE-2026-47729: out-of-bound...

RHLW-2026-D10068B21671906A Lightwell Security Advisory: commons-net 3.8.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.8.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-C7216DB110A73995 Lightwell Security Advisory: commons-net 3.7.2.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.2.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-71F0BC56442456D3 Lightwell Security Advisory: commons-net 3.7.1.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.1.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-20F36034F30C7A24 Lightwell Security Advisory: commons-net 3.5.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.5.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-E16A7A7E33D1BD95 Lightwell Security Advisory: commons-net 3.6.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.6.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-94B9703160382A25 Lightwell Security Advisory: commons-net 3.4.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.4.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-B6AD3B6E26EC332F Lightwell Security Advisory: commons-net 3.3.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.3.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-CE8CAF53627ADA47 Lightwell Security Advisory: commons-net 3.2.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.2.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-93C3DAF552B9D6BC Lightwell Security Advisory: commons-net 2.0.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 2.0.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

SUSE SLES16 Security Update : wget (SUSE-SU-2026:23991-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23991-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Tenable has...

Cisco ASA Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2019-12673)

A vulnerability in the FTP inspection engine of Cisco Adaptive Security ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient validatio...

Cisco ASA Improper Access Control (CVE-2020-3564)

A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacke...

Malicious Package

Overview hardhat-ftp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in hardhat-ftp (npm)

Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array, hex-renamed identifiers, control-flow flattening,...