1790 matches found
CVE-2026-53994 ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
CVE-2026-53994
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
CVE-2026-53994
ProFTPD mod_sftp has a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts an attacker-controlled 32-bit big-endian SFTP packet length without minimum sanity checks. A value of 0 underflows in the read path, yielding an oversized request (~4 ...
CVE-2026-53994
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
[SECURITY] Fedora 43 Update: proftpd-1.3.9c-1.fc43
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...
[SECURITY] Fedora 44 Update: proftpd-1.3.9c-1.fc44
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...
CVE-2026-53994: Heap-based Buffer Overflow
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
PT-2026-60983
Name of the Vulnerable Software and Affected Versions ProFTPD mod sftp affected versions not specified Description An authenticated SFTP user can trigger a heap-based buffer overflow. The fxp packet read function fails to perform a minimum sanity check on the attacker-supplied 32-bit big-endian...
Fedora 43 : proftpd (2026-75a8969e55)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-75a8969e55 advisory. Cumulative bug-fix update, including several buffer overflow fixes. Tenable has extracted the preceding description block directly from the Fedora security...
Fedora 44 : proftpd (2026-2f95481529)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2f95481529 advisory. Cumulative bug-fix update, including several buffer overflow fixes. Tenable has extracted the preceding description block directly from the Fedora security...
cybersecurity-exam-report
Cybersecurity Exam Project: ProFTPD Exploitation and MySQL Dat...
EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-2554)
According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : modsql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER...
EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-2614)
According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : modsql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER...
Slackware Linux 15.0 / current proftpd Vulnerability (SSA:2026-189-02)
The version of proftpd installed on the remote host is prior to 1.3.9c. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-189-02 advisory. New proftpd packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...
[slackware-security] proftpd
New proftpd packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/proftpd-1.3.9c-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: ExecEnviron values not passed due to...
SUSE CVE-2026-35025
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...
Linux Distros Unpatched Vulnerability : CVE-2026-35025
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restriction...
CVE-2026-35025
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...
UBUNTU-CVE-2026-35025
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...
CVE-2026-35025
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in...