180 matches found
CVE-2022-20818
CVE-2022-20818: Local Privilege Escalation via Partial File Read in Cisco SD-WAN The “config - load” feature from Viptela SSH shell uses “wget” to fetch remote “command” files over FTP. By hosting a malicious FTP server and replacing the local files created by wget with symlinks, an attacker can...
[SECURITY] [DSA 6606-1] squid security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6606-1 [email protected] https://www.debian.org/security/ Aron Xu November 03, 2026 https://www.debian.org/security/faq -...
CVE-2026-119146
A flaw was found in ProFTPD. A remote, potentially unauthenticated attacker can trigger a buffer overflow in the modrewrite module by sending File Transfer Protocol FTP command arguments that exceed the internal buffer length. Successful exploitation corrupts session memory and terminates the...
SUSE CVE-2026-71311
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-39983)
Summary There are vulnerabilities in basic-ftp-5.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39983. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39983 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows F...
FTP command injection via CRLF in control channel arguments
Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...
Linux Distros Unpatched Vulnerability : CVE-2026-71311
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filena...
CVE-2026-71311: Improper Neutralization of CRLF Sequences
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
CVE-2026-39983
Summary: CVE-2026-39983 affects the Node.js FTP client package basic-ftp prior to v5.2.1. The vulnerability arises from FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level APIs (cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), removeDir()). Th...
CVE-2026-39983
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences \r\n in file path parameters passed to high-level path APIs such as cd, remove, rename, uploadFrom, downloadTo, list, and removeDir. The library's protectWhitespace helper only handle...
CVE-2026-39983: Improper Neutralization of CRLF Sequences
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences \r\n in file path parameters passed to high-level path APIs such as cd, remove, rename, uploadFrom, downloadTo, list, and removeDir. The library's protectWhitespace helper only handle...
basic-ftp has FTP Command Injection via CRLF
Summary basic-ftp version 5.2.0 allows FTP command injection via CRLF sequences \r\n in file path parameters passed to high-level path APIs such as cd, remove, rename, uploadFrom, downloadTo, list, and removeDir. The library's protectWhitespace helper only handles leading spaces and returns other...
CVE-2009-4769
Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow 1 remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow 2 remote authenticated users t...
CVE-2021-41636
MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...
CVE-1999-0349
A buffer overflow in the FTP list ls command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arbitrary commands...
EUVD-2004-1635
Malware in sbrugna...
EUVD-2007-1725
Malware in sbrugna...
EUVD-2004-2359
Malware in sbrugna...