Cross site scripting

Accellion FTA 912432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA912444 and later...

CVE-2021-27730

Accellion FTA 912432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA912444 and later...

CVE-2021-27730

The CVE-2021-27730 issue concerns Accellion FTA (versions up to 9_12_432). It describes an argument injection vulnerability accessible via a crafted POST to an admin endpoint. A fix is available in version FTA_9_12_444 and later. Impact is noted in public metrics (e.g., CVSS) as high/critical dep...

CVE-2021-27731

Accellion FTA 912432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA912444 and later...

CVE-2021-27731

Accellion FTA vulnerable to a stored XSS flaw (CVE-2021-27731) in 9_12_432 and earlier, triggered by a crafted POST to a user endpoint. The issue is mitigated in FTA_9_12_444 and later. Connected sources confirm the vulnerability type and the fixed version, and note that exploitation details or i...

CVE-2021-27731: Improper Neutralization of Input During Web Page Generation

Accellion FTA 912432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA912444 and later...

CVE-2021-27730: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Accellion FTA 912432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA912444 and later...

Accellion FTA 跨站脚本漏洞

Accellion FTA is an enterprise content firewall from Accellion USA, Inc. provides a protection against data leaks and breaches from third-party network risks. A cross-site scripting vulnerability exists in Accellion FTA 912432 and earlier, which stems from a stored XSS via a POST request to the...

Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks

Cybersecurity researchers on Monday tied a string of attacks targeting Accellion File Transfer Appliance FTA servers over the past two months to data theft and extortion campaign orchestrated by a cybercrime group called UNC2546. The attacks, which began in mid-December 2020, involved exploiting...

Accellion FTA Zero-Day Attacks Tied to Clop, FIN11

Researchers have identified a set of threat actors dubbed UNC2546 and UNC2582 with connections to the FIN11 and the Clop ransomware gang as the cybercriminal group behind the global zero-day attacks on users of the Accellion legacy File Transfer Appliance product. Click to Register Multiple...

Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion

Starting in mid-December 2020, malicious actors that Mandiant tracks as UNC2546 exploited multiple zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance FTA to install a newly discovered web shell named DEWMODE. The motivation of UNC2546 was not immediately apparent, but starting...

Accellion FTA OS Command Injection Vulnerability (CNVD-2021-11053)

Accellion File Transfer Appliance FTA is a secure file transfer service that allows users to share and synchronize files online, all encrypted with AES 128/256. An OS command injection vulnerability exists in Accellion FTA 912411 and earlier versions. The vulnerability can be exploited to execute...

Accellion FTA SQL Injection Vulnerability

Accellion File Transfer Appliance FTA is a secure file transfer service that allows users to share and synchronize files online, all encrypted with AES 128/256. A SQL injection vulnerability exists in Accellion FTA 912370 and earlier versions. The vulnerability can be exploited to conduct a SQL...

CVE-2021-27104

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later...

CVE-2021-27101

Accellion FTA 912370 and earlier is affected by SQL injection via a crafted Host header in a request to documentroot.html. The fixed version is FTA912380 and later...

CVE-2021-27101

Accellion FTA 912370 and earlier is affected by SQL injection via a crafted Host header in a request to documentroot.html. The fixed version is FTA912380 and later...

CVE-2021-27102

Accellion FTA 912411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA912416 and later...

Command injection

Accellion FTA 912411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA912416 and later...

Design/Logic Flaw

Accellion FTA 912411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA912416 and later...

Sql injection

Accellion FTA 912370 and earlier is affected by SQL injection via a crafted Host header in a request to documentroot.html. The fixed version is FTA912380 and later...