CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

CVE-2017-8760

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...

CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...

CVE-2017-8794

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

CVE-2017-8791

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

Sql injection

An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...

Remote code execution

An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

Server side request forgery (ssrf)

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

Security feature bypass

An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI...

CVE-2017-8790

An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...

CVE-2017-8789

An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...

CVE-2017-8791

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

CVE-2017-8793

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...

CVE-2017-8795

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...

CVE-2017-8788

CVE-2017-8788 affects Accellion FTA devices prior to FTA_9_12_180. A CRLF injection vulnerability exists in settings_global_text_edit.php that enables newline/CRLF payloads (e.g., ?display=x%0Dnewline) and, per CNVD/NVD records, can allow remote command execution. Impact details in the connected ...