397 matches found
CVE-2023-0669
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...
Command injection
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...
CVE-2023-0669 Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...
CVE-2023-0669
Fortra GoAnywhere MFT is affected by CVE-2023-0669, a pre-authentication deserialization vulnerability in the License Response Servlet that enables remote code execution by deserializing attacker-controlled objects. Exploitation and PoCs exist in public exploits/analyses; vendors patched the issu...
CVE-2023-0669 Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...
CVE-2023-0669
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2. Recent assessments: rbowes-r7 at February 06, 2023...
Warning: Hackers Actively Exploiting Zero-Day in Fortra's GoAnywhere MFT
A zero-day vulnerability affecting Fortra's GoAnywhere MFT managed file transfer application is being actively exploited in the wild. Details of the flaw were first publicly shared by security reporter Brian Krebs on Mastodon. No public advisory has been published by Fortra. The vulnerability is ...
Exploitation of GoAnywhere MFT zero-day vulnerability
Emergent threats evolve quickly. As we learn more about this vulnerability, we will update this blog post with relevant information about technical findings, product coverage, and other information that can assist you with assessment and mitigation. On Thursday, February 2, 2023, security reporte...
PT-2023-1431
Name of the Vulnerable Software and Affected Versions Fortra GoAnywhere MFT versions prior to 7.1.2 Description Fortra GoAnywhere MFT is susceptible to a pre-authentication command injection due to the deserialization of attacker-controlled objects within the License Response Servlet. The Clop...
PT-2023-33546 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 6.0.17 Description: A potential issue exists in the fs/ntfs3 component, specifically in the ntfs read mft function, where a duplicate condition is deleted. The actual impact and attack plausibility of this issue...
Velociraptor Version 0.6.7: Better Offline Collection, Encryption, and an Improved NTFS Parser Dig Deeper Than Ever
By Mike Cohen and Carlos Canto Rapid7 is excited to announce the release of version 0.6.7 of Velociraptor – an advanced, open-source digital forensics and incident response DFIR tool that enhances visibility into your organization’s endpoints. This release has been in development and testing for...
PT-2022-33391 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15 through v5.19.3 Description: A potential security issue has been identified in the Linux Kernel, related to the ntfs read mft function. The actual impact and attack plausibility have not yet been proven...
CVE-2021-46830
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a...
Path traversal
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a...
CVE-2021-46830
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a...
CVE-2021-46830
The CVE-2021-46830 issue affects HelpSystems GoAnywhere MFT, specifically the Web Client self-registration feature. A path traversal vulnerability exists in GoAnywhere MFT versions prior to 6.8.3, where an external user who self-registers with a crafted username and/or profile information could a...
PT-2022-12936 · Unknown · Goanywhere Mft
Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 6.8.3 Description: A path traversal issue exists that could allow an external user who self-registers with specific username and/or profile information to access files at a higher directory level than intended...
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
...
Tuxera NTFS-3G Buffer Overflow Vulnerability (CNVD-2022-82646)
Tuxera NTFS-3G is an open source, cross-platform set of drivers from Tuxera Finland for reading and writing to NTFS partitions. tuxera NTFS-3G is vulnerable to a buffer overflow vulnerability that originates from a boundary error in ntfsmftrecalloc when handling untrusted input, which can be...
