Accellion FTA Device SQL Injection Vulnerability (CNVD-2017-07454)

Accellion FTA devices is a file transfer device from Accellion USA. The device supports file transfer, file sharing, file transfer tracking and reporting, and more. A SQL injection vulnerability exists in the reporterror.php file in versions of Accellion FTA devices prior to FTA912180. A remote...

CVE-2017-8796

An issue was discovered on Accellion FTA devices before FTA912180. Because mysqlrealescapestring is misused, seos/courier/communicationp2p.php allows SQL injection with the appid parameter...

Accellion File Transfer Appliance Arbitrary Command Execution Vulnerability

Accellion File Transfer Appliance FTA is a file transfer solution from Accellion USA. The solution supports file transfer, file sharing, file transfer tracking and reporting, and more. A security vulnerability exists in Accellion FTA versions prior to FTA91240. A remote attacker can exploit the...

CVE-2016-2352

The Accellion File Transfer Appliance FTA before FTA91240 allows remote authenticated users to execute arbitrary commands by leveraging the YUMCLIENT restricted-user role...

Sql injection

SQL injection vulnerability in home/seos/courier/securitykey2.api on the Accellion File Transfer Appliance FTA before FTA91240 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

Authentication flaw

The Accellion File Transfer Appliance FTA before FTA91240 allows remote authenticated users to execute arbitrary commands by leveraging the YUMCLIENT restricted-user role...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities on the Accellion File Transfer Appliance FTA before FTA91240 allow remote attackers to inject arbitrary web script or HTML via unspecified input to 1 getimageajax.php, 2 movepartitionframe.html, or 3 wmInfo.html...

CVE-2016-2352

The Accellion File Transfer Appliance FTA before FTA91240 allows remote authenticated users to execute arbitrary commands by leveraging the YUMCLIENT restricted-user role...

CVE-2016-2351

CVE-2016-2351 affects the Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40. The vulnerability is an SQL injection in the file path home/seos/courier/security_key2.api that allows a remote attacker to execute arbitrary SQL commands via the client_id parameter, as documented by NVD and ...

CVE-2016-2353

The connected OpenVAS entry identifies multiple vulnerabilities in Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40, including local privilege escalation by allowing a local user to add an SSH key to an arbitrary group, enabling privilege gain. The CVE-2016-2353 entry likewise describ...

PT-2016-5127

Name of the Vulnerable Software and Affected Versions Accellion File Transfer Appliance FTA versions prior to FTA 9 12 40 Description The issue concerns multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via...

PT-2016-5130

Name of the Vulnerable Software and Affected Versions Accellion File Transfer Appliance FTA versions prior to FTA 9 12 40 Description The issue allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors. Recommendations For versions prior...

PT-2016-5129

Name of the Vulnerable Software and Affected Versions Accellion File Transfer Appliance versions prior to FTA 9 12 40 Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by leveraging the YUM CLIENT restricted-user role. Recommendations For...

CVE-2016-2352: Undefined Security Weakness

The Accellion File Transfer Appliance FTA before FTA91240 allows remote authenticated users to execute arbitrary commands by leveraging the YUMCLIENT restricted-user role...

CVE-2016-2353: Undefined Security Weakness

The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...

CVE-2016-2351: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in home/seos/courier/securitykey2.api on the Accellion File Transfer Appliance FTA before FTA91240 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2016-2350: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities on the Accellion File Transfer Appliance FTA before FTA91240 allow remote attackers to inject arbitrary web script or HTML via unspecified input to 1 getimageajax.php, 2 movepartitionframe.html, or 3 wmInfo.html...

PT-2016-5128

Name of the Vulnerable Software and Affected Versions Accellion File Transfer Appliance FTA versions prior to FTA 9 12 40 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the client id parameter in the "home/seos/courier/security key2.api"...

Accellion Secure File Transfer Appliance 'oauth_token' Parameter Remote Command Execution

The remote Accellion Secure File Transfer Appliance is affected by a remote command execution vulnerability due to improper sanitization of user-supplied in put to the 'oauthtoken' parameter in the getoauthcustomername and verifyoauthtoken functions. The parameter is passed to a system command...

Accellion Secure File Transfer Appliance 'statecode' Cookie Remote File Disclosure

The remote Accellion Secure File Transfer Appliance is affected by an arbitrary file disclosure vulnerability due to improper sanitization of user-supplied input to the 'statecode' cookie used by the template function in function.inc. A remote, unauthenticated attacker can exploit this...