WebCatalog Security Vulnerabilities

WebCatalog is a desktop application from WebCatalog, Inc. that improves workflow and increases productivity. A security vulnerability exists in WebCatalog versions prior to 49.0 that stems from not validating whether a URL is used for an http or https resource...

UBUNTU-CVE-2023-42119

Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp...

CVE-2023-40048

In WSFTP Server version prior to 8.8.2, the WSFTP Server Manager interface was missing cross-site request forgery CSRF protection on a POST transaction corresponding to a WSFTP Server administrative function...

CVE-2023-40044

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

CVE-2023-40045

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting XSS vulnerability exists in WSFTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WSFTP Server users with a specialized payload which results in the execution of malicious...

CVE-2023-40045

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting XSS vulnerability exists in WSFTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WSFTP Server users with a specialized payload which results in the execution of malicious...

CVE-2023-40044

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

Deserialization of untrusted data

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

Cross site scripting

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting XSS vulnerability exists in WSFTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WSFTP Server users with a specialized payload which results in the execution of malicious...

CVE-2023-40045

CVE-2023-40045 is a reflected cross-site scripting (XSS) vulnerability in WS_FTP Server’s Ad Hoc Transfer module, affecting versions prior to 8.7.4 and 8.8.2. The flaw allows an attacker to deliver a payload that executes malicious JavaScript in the victim’s browser. Root cause: lack of proper in...

CVE-2023-40044 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

CVE-2023-40044

CVE-2023-40044 affects Progress Software WS_FTP Server, exploiting a deserialization flaw in the Ad Hoc Transfer module to achieve remote code execution. A pre-authenticated attacker can trigger this via the vulnerable .NET deserialization path in WS_FTP Server versions prior to 8.7.4 (and 8.8.2)...

CVE-2023-40045: Improper Neutralization of Input During Web Page Generation

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting XSS vulnerability exists in WSFTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WSFTP Server users with a specialized payload which results in the execution of malicious...

Progress Software WS_FTP Server Code Issue Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A code issue vulnerability exists in Progress Software WSFTP Server versions prior to 8.7.4, 8.8.2. An attacker can exploit this vulnerability to remotely execute arbitrary commands...

PT-2023-5688

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.7.4 and 8.8.2 Description The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to...

WS_FTP Server Path Traversal Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A security vulnerability exists in WSFTP Server versions prior to 8.7.4, 8.8.2. An attacker can exploit the vulnerability to read arbitrary files on the server running the application...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-007)

The version of tomcat installed on the remote host is prior to 8.5.69-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-007 advisory. A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid...

CVE-2023-40044: Deserialization of Untrusted Data

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-007)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-007 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding...

WS_FTP Server Cross-Site Scripting Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A cross-site scripting vulnerability exists in WSFTP Server versions prior to 8.8.2. An attacker could exploit this vulnerability to execute malicious JavaScript in the victim's browser...