CVE-2020-26299

Summary: CVE-2020-26299 affects the ftp-srv npm package (FTP server) prior to 4.4.0. The root cause is how Windows path separators () interact with path.resolve, leaving an upper pointer intact and allowing a user to move beyond the defined FTP root via commands like CWD/UPDR. Impact: potential p...

ftp-srv Path Traversal Vulnerability

Connor Skees ftp-srv is an open source application from Connor Skees. Provides a modern and scalable FTP server designed to be simple but configurable. A path traversal vulnerability exists in ftp-srv, which arises from a failure of a network system or product to properly filter special elements ...

Serv-U FTP Server < 15.2.2 Hotfix 1 Arbitrary File Read/Write

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

SolarWinds Serv-U FTP Server Cross-Site Scripting Vulnerability (CNVD-2021-14805)

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A cross-site scripting vulnerability exists in SolarWinds Serv-U before 15.2.2, which allows reflection of XSS via authentication.No detailed vulnerability details are available at this time...

Design/Logic Flaw

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

3 New Severe Security Vulnerabilities Found In SolarWinds Software

Cybersecurity researchers on Wednesday disclosed three severe security vulnerabilities impacting SolarWinds products, the most severe of which could have been exploited to achieve remote code execution with elevated privileges. Two of the flaws CVE-2021-25274 and CVE-2021-25275 were identified in...

3 New Severe Security Vulnerabilities Found In SolarWinds Software

Cybersecurity researchers on Wednesday disclosed three severe security vulnerabilities impacting SolarWinds products, the most severe of which could have been exploited to achieve remote code execution with elevated privileges. Two of the flaws CVE-2021-25274 and CVE-2021-25275 were identified in...

SolarWinds Serv-U FTP Server Authorization Issues Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds Corporation. A security vulnerability exists in SolarWinds Serv-U before 15.2.2 Hotfix 1, which stems from a directory containing a user configuration file which includes a user's password...

SolarWinds Serv-U FTP Server 跨站脚本漏洞

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A cross-site scripting vulnerability exists in SolarWinds Serv-U before 15.2.2, which allows reflection of XSS via authentication.No detailed vulnerability details are available at this time...

SolarWinds Serv-U FTP Server Path Traversal Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. A path traversal vulnerability exists in SolarWinds Serv-U before 15.2.2 that allows authenticated directory traversal...

Agent Tesla Malware Spotted Using New Delivery & Evasion Techniques

Security researchers on Tuesday uncovered new delivery and evasion techniques adopted by Agent Tesla remote access trojan RAT to get around defense barriers and monitor its victims. Typically spread through social engineering lures, the Windows spyware not only now targets Microsoft's Antimalware...

Exploit for Path Traversal in Atlassian Confluence_Server

cve-2019-3396 Unauthenticated Confluence RCE cve-2019-339...

Wing FTP Cross-Site Scripting Vulnerability

Wing FTP Server is a cross-platform FTP server software. A cross-site scripting vulnerability exists in Wing FTP version 6.4.4, where an arbitrary IFRAME element can be included in a help page via a specially crafted link, which can be exploited by an attacker to execute sandbox arbitrary HTML an...

CVE-2020-25785

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CFtpProtocol::FtpLogin during the update procedure...

Infoscience Logstorage and Infoscience ELC Analytics Operating System Command Injection Vulnerability

Infoscience Logstorage and Infoscience ELC Analytics are both products of Infoscience Japan.Infoscience Logstorage is an integrated log management tool. The device collects logs from all company information systems for integrated management.Infoscience ELC Analytics is a server log management too...

Accfly Wireless Security IR Camera System 720P Software 缓冲区错误漏洞

Accfly Wireless Security IR Camera System 720P Software is an application from Accfly USA for controlling this camera. A buffer overflow vulnerability exists in Accfly Wireless Security IR Camera System 720P Software versions v3.10.73 through v4.15.77, which stems from an unauthenticated...

JVN#41853173: OS command injection vulnerability in multiple Infoscience Corporation log management tools

Infoscience Corporation's multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads. In a situation where the FTP upload function is enabled and there is a flaw of input value handling in...

Command injection

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic...

CVE-2013-2512

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic...

CVE-2013-2512

The CVE-2013-2512 entry concerns the ftpd gem for Ruby (version 0.2.1). Affected component: the FTP command handling (LIST/NLST) that accepts arguments containing shell metacharacters. Root cause: improper sanitization allows remote attackers to execute arbitrary OS commands through crafted FTP t...