CVE-2021-41635

When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system...

CVE-2021-41637

Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users...

CVE-2021-41638

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

CVE-2021-41636

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

CVE-2021-41638

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

CVE-2021-41634

A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames...

CVE-2021-41634

A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames...

Design/Logic Flaw

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

Authentication flaw

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

Design/Logic Flaw

Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users...

Design/Logic Flaw

MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file...

Design/Logic Flaw

A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames...

Information disclosure

When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system...

CVE-2021-41634

The CVE-2021-41634 issue affects MELAG FTP Server version 2.2.0.4, where the service’s authentication-related responses differ between valid usernames and non-users, enabling an attacker to enumerate valid FTP usernames. This root cause is described in CNVD-2022-65337 as a response-difference log...

CVE-2021-41634

A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames...

CVE-2021-41635

When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system...

CVE-2021-41635

The CVE-2021-41635 entry concerns MELAG FTP Server 2.2.0.4 on Windows. When installed as a Windows service, the server runs with SYSTEM privileges, enabling a remote attacker to abuse misconfigurations or vulnerabilities to obtain administrative access over the entire host system. The connected d...

CVE-2021-41636

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

CVE-2021-41636

MELAG FTP Server 2.2.0.4 exposes a directory-traversal issue: the CWD command can break out of the FTP server’s root and allow an attacker to operate on the underlying OS, constrained only by the user’s access restrictions. Affected: MELAG FTP Server 2.2.0.4. Root cause: path handling in CWD enab...

CVE-2021-41637

CVE-2021-41637 concerns MELAG FTP Server 2.2.0.4 with weak access control that permits the Everyone group to read the local FTP configuration file, exposing unencrypted passwords of all FTP users. The connected CNVD/CVE entries describe this as an authorization issue rooted in improper file permi...