DEBIAN-CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

Design/Logic Flaw

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

UBUNTU-CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

CVE-2022-32278 affects XFCE Exo (XFCE 4.16) where xdg-open can execute a .desktop file hosted on an attacker-controlled FTP server, enabling arbitrary code execution. Root cause: insecure handling of .desktop files in remote sources. Affected component: exo (XFCE library). Impact: remote code exe...

Monsta FTP 代码问题漏洞

Monsta FTP is a modern web interface for FTP. A security vulnerability exists in Monsta FTP version v2.10.3, which stems from a server-side request forgery SSRF vulnerability discovered via the performFetchRequest function in HTTPFetcher.php...

CVE-2022-29620

FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability...

Design/Logic Flaw

DISPUTED FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability...

CVE-2022-29620

FileZilla v3.59.0 is affected by a memory-dump exposure where an attacker can obtain cleartext passwords of connected SSH/FTP servers. This is consistently described across Red Hat, Ubuntu, NVD, CVE records, and CNNVD, all noting the vendor does not consider it a vulnerability or a lack of a publ...

CLSA-2022-1654525948 Fixed CVEs in python2-pip-18.module_el8.4.0+2051+0b56c8de: CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-4189

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

[slackware-security] pidgin

New pidgin packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/pidgin-2.14.10-i586-1slack15.0.txz: Upgraded. This update fixes bugs and several security issues. For more information, see:...

curl: KRB-FTP: Security level downgrade

Summary: libcurl doesn't fail the FTP connection if Kerberos authentication fails for some reason, but rather reverts back to using regular clear text password authentication. The logic is inlib/ftp.c ftpstatemachine:...

curl: CVE-2022-32208: FTP-KRB bad message verification

Summary: libcurl handles gssunwrap GSSSBADSIG error incorrectly. This enables malicious attacker to inject arbitrary FTP server responses to GSSAPI protected FTP control connection and/or make the client consume unrelated heap memory as a FTP command response. The defective krb5decode function is...

Researchers Demonstrate Ransomware for IoT Devices That Targets IT and OT Networks

As ransomware infections have evolved from purely encrypting data to schemes such as double and triple extortion, a new attack vector is likely to set the stage for future campaigns. Called Ransomware for IoT or R4IoT by Forescout, it's a "novel, proof-of-concept ransomware that exploits an IoT...

PT-2022-5557

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.84.0 Description The issue is related to how curl handles message verification failures when doing FTP transfers secured by krb5. This flaw allows a Man-In-The-Middle attack to go unnoticed and enables the injection of...

CLSA-2022-1654010877 Fixed CVEs in python3: CVE-2022-0391, CVE-2021-4189, CVE-2021-3737

CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2036020 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2036020 - CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs rhbz2047376...

EulerOS 2.0 SP3 : python (EulerOS-SA-2022-1757)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into...