1239 matches found
CVE-2021-27649
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...
PT-2021-17581 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to a use after free vulnerability in the file transfer protocol component. This allows remote attackers to execute arbitrary code via unspecifi...
Synology DiskStation Manager 资源管理错误漏洞
DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in the File Transfer Protocol component in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker...
CVE-2021-27649: Use After Free
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used
Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...
curl: FTP PASV command response can cause curl to connect to arbitrary host
A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If cu...
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used
Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...
curl: FTP PASV command response can cause curl to connect to arbitrary host
A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If cu...
The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, relates to errors in processing new line symbols in FTP URLs. This vulnerability allows attackers to send arbitrary commands to the FTP server.
The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to errors in processing new line characters in FTP URL addresses such as %0A or %0D. Exploiting this vulnerability allows a remote attacker to send arbitrary commands to the FTP server...
The vulnerability of the programmable logic controller Schneider Electric Modicon Quantum, related to the insufficient reliability of passwords, allows a intruder to alter the contents of configuration files.
The vulnerability of the programmable logic controller Schneider Electric Modicon Quantum is related to the insufficient security of passwords. Exploiting this vulnerability could allow an attacker to modify the contents of configuration files using the built-in FTP server passwords...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
The vulnerability of the update function in FlexConnect microprogramming software for Cisco Aironet Access Points allows a intruder to disclose protected information.
The vulnerability of the update function in FlexConnect microprogramming software for Cisco Aironet Access Points is related to improper handling of permissions. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information by sending TFTP requests to the vulnerable...
Haxx libcurl 信息泄露漏洞
HAXX Haxx libcurl is a free, open source client-side URL transport library from the Swedish company HAXX. The library supports FTP, FTPS, TFTP, HTTP and more. An information disclosure vulnerability exists in Haxx libcurl, which can be exploited by an attacker to bypass access restrictions on dat...
Cisco Aironet Series Access Points Software 安全漏洞
Cisco Aironet Series Access Points Software is a suite of software from Cisco that is used in Aironet wireless access point devices. A security vulnerability exists in the Cisco Aironet Series Access Points Software, which arises from an unrestricted TFTP configuration, and can be exploited by an...
CVE-2021-27221
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work...