19487 matches found
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102727
Technical details are not publicly available in the provided documents regarding CVE-2026-102727 . The description indicates an FTP Passive Data Connection Not Bound to the Authenticated Control Peer , but no specific product, version, or root cause is provided. Action: monitor for updates.
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
CVE-2026-102727
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
EUVD-2026-89199
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
CVE-2026-102722
The FTP Client is vulnerable to a flaw in the IPv4 PASV path where it accepts any address provided in the server's 227 reply . Because validation only ensures the address parses correctly and contains non-zero values, a malicious server can specify an arbitrary address to redirect the client. No ...
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
EUVD-2026-89187
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's "227" reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
PT-2026-102793
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The issue involves an FTP passive data connection that is not bound to the authenticated control peer, which could allow an unauthorized party to intercept or...
CVE-2026-102722: Server-Side Request Forgery (SSRF)
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102727: Improper Restriction of Communication Channel to Intended Endpoints
FTP Passive Data Connection Not Bound to the Authenticated Control Peer...
PT-2026-102788
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In the IPv4 PASV path, the FTP Client accepts any address provided in the server's 227 reply. Because validation is limited to parsing and checking for non-zero...
CVE-2026-63447
A flaw was found in Suricata. A remote, unauthenticated attacker can exploit this issue by sending specially crafted File Transfer Protocol FTP traffic containing large command sequences, causing the parser to allocate transactions beyond expected limits. Processing this oversized transaction lis...
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...
CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...