CVE-2017-15269

The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. These can be performed using "nmap -b" and allow performing scans via the FTP server...

PSFTPd Windows FTP Server Memory Misreference Vulnerability

PSFTPd is a suite of FTP server software. The software supports protocols such as FTP, FTPS and SFTP.SFTP component is one of the secure file transfer components. A memory misreference vulnerability exists in the SFTP component of PSFTPd version 10.0.4 Build 729. A remote attacker can exploit thi...

[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

jsch: ChannelSftp path traversal vulnerability

A vulnerability was discovered in JSch that allows a malicious sftp server to force a client-side relative path traversal in jsch's implementation for recursive sftp-get. An attacker could leverage this to write files outside the client's download basedir with effective permissions of the jsch sf...

Insecure Defaults

cordova-plugin-file-transfer has insecure default. The default value for trustAllHosts is true for iOS applications. By using this flaw, attackers can easily spoof SSL servers and have them be trusted by the application...

Code injection

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2014-0072

CVE-2014-0072 affects the Apache Cordova File-Transfer stack on iOS. The File-Transfer plugin for iOS (Cordova 2.4.0–2.9.0) and the standalone File-Transfer plugin (org.apache.cordova.file-transfer) prior to 0.4.2 default the trustAllHosts option to true, allowing remote attackers to spoof SSL se...

Ayukov NFTPD Buffer Overflow Vulnerability

Ayukov NFTPD is a file transfer protocol client. A buffer overflow vulnerability exists in Ayukov NFTPD 2.0 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary code...

OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612)

It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...

OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612)

It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...

OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612)

It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...

OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612)

It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...

Pidgin MXIT File Transfer Length Memory Disclosure Vulnerability(CVE-2016-2372)

DESCRIPTION An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for a file transfer which will trigger ...

Buffer overflow

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...

CVE-2017-5531

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...

CVE-2017-5531

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...

CVE-2017-5531

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...

CVE-2015-2856

Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA911210 allows remote attackers to read arbitrary files via a .. dot dot in the statecode cookie...