ALPINE-CVE-2021-31810

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

Trusting FTP PASV responses vulnerability in Net::FTP

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

The vulnerability of the Adobe InCopy text creation and editing software lies in its lack of path name checking for restricted access directories, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe InCopy text creation and editing software is related to deficiencies in checking the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context of the current user, through a specially craft...

Vulnerability of the ftpd/popen component of the ftpd service on FreeBSD and OpenBSD operating systems, allowing attackers to cause service failures.

The vulnerability of the ftpd/popen component of the ftpd service in FreeBSD and OpenBSD is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2021-33540

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

Synology DiskStation Manager Post-Release Reuse Vulnerability (CNVD-2021-45739)

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in the File Transfer Protocol component in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker...

CVE-2021-27649

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2021-27649

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

Design/Logic Flaw

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2021-27649

CVE-2021-27649 affects Synology DiskStation Manager (DSM) via a use-after-free in the DSM File Transfer Protocol component. The vulnerability allows remote code execution on DSM versions prior to 6.2.3-25426-3. Evidence from multiple sources (NVD, CNVD, Tenable OT/OSS plugin references, OpenVAS e...

CVE-2021-27649

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2021-27649

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2021-17581 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to a use after free vulnerability in the file transfer protocol component. This allows remote attackers to execute arbitrary code via unspecifi...

CVE-2021-27649: Use After Free

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors...

Synology DiskStation Manager 资源管理错误漏洞

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in the File Transfer Protocol component in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker...

curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used

Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...

curl: FTP PASV command response can cause curl to connect to arbitrary host

A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If cu...

curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used

Libcurl offers a wildcard matching functionality, which allows a callback set with CURLOPTCHUNKBGNFUNCTION to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns...

curl: FTP PASV command response can cause curl to connect to arbitrary host

A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If cu...

The vulnerability of the Account Hierarchy Manager component of the Oracle General Ledger financial processing system allows a hacker to gain access to create, modify, or delete data.

The vulnerability of the Account Hierarchy Manager component in the Oracle General Ledger financial processing system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to create, modify, or delete data using the HTTP protocol...