CVE-2017-8760

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...

PT-2017-18531

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered that allows for a CRLF attack vector through the auth params in the "home/seos/courier/login.html" endpoint. Recommendations For versions prior to FTA 9 12 180,...

PT-2017-18510

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered that allows for cross-site scripting XSS in the courier/1000@/index.html endpoint with the auth params parameter. The device attempts to mitigate specific XSS...