174 matches found
WinSCP proteciton bypass
Server X.509 certificate is not validated...
CVE-2014-2735 - WinSCP: missing X.509 validation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-003 Product: WinSCP Affected Versions: 5.5.2.4130 Tested Versions: 5.5.2.4130 Windows 7 32 bit and Windows 8.1 64 bit Vulnerability Type: Missing X.509 validation Risk Level: Medium Solution Status: Fixed Vendor Notification:...
CVE-2014-2735
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
Code injection
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
KLA10396 SB vulnerability in WinSCP
A lack of hostname verifications was found in the WinSCP. By exploiting this vulnerability malicious users can spoof the SSL server. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products WinSCP CVE list CVE-2014-2735 high Solution Upda...
CVE-2014-2735
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2014-2735
WinSCP (Windows FTP client) is affected by CVE-2014-2735 due to missing validation of the server X.509 certificate hostname when using FTP over TLS. The issue allows MITM spoofing of SSL servers with an arbitrary valid certificate because the client does not verify the CN or subjectAltName. Affec...
WinSCP Heartbeat Information Disclosure (Heartbleed)
The WinSCP program installed on the remote host is version 4.x later than 4.3.7, 5.x later than 5.0.6 and prior to 5.5.3. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions...
WinSCP < 5.1.6 RSA Signature Blob Integer Overflow
The WinSCP program installed on the remote host is a version prior to 5.1.6. It therefore contains code from PuTTY that is affected by an integer overflow related to handling RSA signature data. This error allows a remote attacker to crash the application. C Tenable Network Security, Inc...
WinSCP < 5.1.7 Multiple Vulnerabilities
The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. CVE-2013-4206 - A buffer...
WinSCP Installed
Binary data winscpinstalled.nbin...
WinSCP Detection (Windows SMB Login)
SMB login-based detection of WinSCP. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...
WinSCP Integer Overflow Vulnerability - Windows
WinSCP is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:winscp:winscp"; if...
DEBIAN-CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...
CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...
CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...
Integer overflow
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...
UBUNTU-CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...
CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service crash and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the S...