175 matches found
CVE-2017-8794
An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...
CVE-2017-8303
An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...
CVE-2017-8304
Accellion FTA devices prior to FTA_9_12_180 are affected by a cross-site scripting vulnerability in courier/1000@/oauth/playground/callback.html triggered by a crafted URI. CNVD/NVD entries corroborate a via-URL XSS in the Accellion FTA web UI, listed as CVE-2017-8304. The provided documents do n...
CVE-2017-8796
An issue was discovered on Accellion FTA devices before FTA912180. Because mysqlrealescapestring is misused, seos/courier/communicationp2p.php allows SQL injection with the appid parameter...
CVE-2017-8792
The CVE-2017-8792 entry concerns Accellion FTA devices prior to FTA_9_12_180 with a Cross‑Site Scripting (XSS) flaw in the web page path home/seos/courier/user_add.html, exploitable via the parameter field. The connected documents consistently describe the vulnerability as XSS; no exploit details...
CVE-2017-8304: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Accellion FTA devices before FTA912180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI...
CVE-2017-8790: Improper Neutralization of Special Elements used in an LDAP Query
An issue was discovered on Accellion FTA devices before FTA912180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection...
CVE-2017-8793: Origin Validation Error
An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...
CVE-2017-8792: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...
CVE-2017-8796: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered on Accellion FTA devices before FTA912180. Because mysqlrealescapestring is misused, seos/courier/communicationp2p.php allows SQL injection with the appid parameter...
CVE-2017-8791: Improper Neutralization of CRLF Sequences
An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...
CVE-2017-8789: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered on Accellion FTA devices before FTA912180. A reporterror.php?year='payload SQL injection vector exists...
CVE-2017-8794: Server-Side Request Forgery (SSRF)
An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...
CVE-2017-8788: Improper Neutralization of CRLF Sequences
An issue was discovered on Accellion FTA devices before FTA912180. There is a CRLF vulnerability in settingsglobaltextedit.php allowing ?display=x%0Dnewline attacks...
CVE-2017-8303: Improper Encoding or Escaping of Output
An issue was discovered on Accellion FTA devices before FTA912180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter...
CVE-2017-8760: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...
CVE-2017-8795: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/smtpgadd.html with the param parameter...
Accellion FTA Multiple Vulnerabilities
Accellion FTA is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Accellion FTA getStatus verify_oauth_token Command Execution (CVE-2015-2857)
A command execution vulnerability exists in Accellion File Transfer appliance. The vulnerability is due to insufficient sanitization of the oauthtoken parameter. A remote attacker can exploit this vulnerability by sending crafted request to the affected appliance...
