175 matches found
CVE-2017-8795
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...
CVE-2017-8795
Summary of CVE-2017-8795 (Accellion FTA) : A cross-site scripting (XSS) flaw exists in Accellion FTA devices before FTA_9_12_180, specifically in the page home/seos/courier/smtpg_add.html where the parameter is unsafely reflected. This affects Accellion FTA devices prior to the cited version; the...
CVE-2017-8790
An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...
CVE-2017-8789
An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...
CVE-2017-8791
An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...
CVE-2017-8791
CVE-2017-8791 affects Accellion FTA devices prior to FTA_9_12_180. The vulnerability is a CRLF injection in the login page parameter path: home/seos/courier/login.html auth_params, allowing a remote attacker to trigger a CRLF-based attack. Public sources in CNVD/NVD confirm a remote-exploitation ...
CVE-2017-8789
Accellion FTA devices prior to FTA_9_12_180 are affected by a SQL injection in the report_error.php?year parameter. The issue allows a remote attacker to potentially execute arbitrary SQL commands against the backend database. Root cause is an injectable SQL vector in report_error.php, exposing c...
CVE-2017-8793
An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...
CVE-2017-8794
Vulnerability: Accellion FTA devices prior to FTA_9_12_180 are affected by CVE-2017-8794. Root cause: a regular expression intended to match local https URLs lacks the initial ^, allowing SSRF via courier/web/1000@/wmProgressval.html with crafted file:///etc/passwd#https:// URLs. Impact: server-s...
CVE-2017-8795
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...
CVE-2017-8788
CVE-2017-8788 affects Accellion FTA devices prior to FTA_9_12_180. A CRLF injection vulnerability exists in settings_global_text_edit.php that enables newline/CRLF payloads (e.g., ?display=x%0Dnewline) and, per CNVD/NVD records, can allow remote command execution. Impact details in the connected ...
CVE-2017-8793
CVE-2017-8793 affects Accellion FTA devices prior to FTA_9_12_180. A POST to home/seos/courier/web/wmProgressstat.html.php with an attacker-controlled acallow parameter can trigger an Access-Control-Allow-Origin header, bypassing Same-Origin Policy and granting the attacker site access. Severity ...
CVE-2017-8760
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...
CVE-2017-8792
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...
CVE-2017-8760
CVE-2017-8760: An XSS vulnerability affecting Accellion FTA devices prior to FTA_9_12_180. The flaw resides in the courier/1000@/index.html page via the auth_params parameter, with the device’s internal WAF filters unable to reliably block certain payloads; bypasses via URL-encoding and similar m...
CVE-2017-8790
Summary: CVE-2017-8790 concerns the Accellion FTA line prior to version FTA_9_12_180. The vulnerability is a LDAP Injection in the web interface, specifically the POST parameter filter in the path home/seos/courier/ldaptest.html. The root cause is improper handling of LDAP queries, allowing a rem...
CVE-2017-8303
Summary : CVE-2017-8303 affects Accellion FTA devices prior to FTA_9_12_180. The connected CNVD/PRION/CVE records corroborate a vulnerability in seos/1000/find.api that enables Remote Code Execution via shell metacharacters in the method parameter. The core detail across sources is the affected s...
CVE-2017-8788
An issue was discovered on Accellion FTA devices before FTA912180. There is a CRLF vulnerability in settingsglobaltextedit.php allowing ?display=x%0Dnewline attacks...