CVE-2007-6739

FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command...

CVE-2009-5012

CVE-2009-5012 affects pyftpdlib before 0.5.2: ftpserver.py does not require the l permission for the MLST command, allowing remote authenticated users to bypass access restrictions and list the root directory via FTP. The issue is tied to the MLST permission check and could enable directory enume...

CVE-2009-5013

CVE-2009-5013 : Pyftpdlib’s FTP server (ftpserver.py) contains a memory leak in the on_dtp_close path for versions before 0.5.2. Remote authenticated users can trigger memory exhaustion/DoS by issuing a QUIT during a data transfer. No remediation details are provided in the connected documents.

CVE-2009-5012

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session...

CVE-2007-6739

The CVE-2007-6739 entry concerns the pyftpdlib FTP server (FTPServer.py) prior to version 0.2.0. The root cause is a vulnerability that allows remote attackers to cause a denial of service by sending a long command. Exploitation is described as remote and lack of authentication is noted in the de...

CVE-2008-7262

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a 1 CWD, 2 DELE, 3 STOR, or 4 RETR command...

CVE-2008-7264

The ftpQUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service file descriptor exhaustion and daemon outage by sending a QUIT command during a disallowed data-transfer attempt...

CVE-2007-6737

CVE-2007-6737 affects pyftpdlib’s FTP server (FTPServer.py) prior to 0.2.0. The root cause is that attempted_logins is not incremented for a USER command with an invalid username, making brute-force access more feasible. Exploitation details are not provided in the documents; remediation/fix deta...

CVE-2007-6738

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command...

CVE-2007-6738

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command...

CVE-2007-6741

The ftpPORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via...

CVE-2008-7263

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2008-7264

The ftpQUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service file descriptor exhaustion and daemon outage by sending a QUIT command during a disallowed data-transfer attempt...

CVE-2010-3494

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

CVE-2008-7262

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a 1 CWD, 2 DELE, 3 STOR, or 4 RETR command...

CVE-2009-5010

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, a different...

CVE-2007-6736

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. dot dot in a 1 LIST, 2 STOR, or 3 RETR command...

CVE-2008-7263

The CVE-2008-7263 entry affects the pyftpdlib FTP server (ftpserver.py) prior to version 0.5.0. The root issue is that it does not delay its response after an invalid login attempt, which makes brute-force access easier for remote attackers. The provided connected documents confirm the affected c...

CVE-2009-5011

The CVE-2009-5011 entry refers to a race condition in pyftpdlib’s FTPHandler (ftpserver.py) prior to version 0.5.2, causing a remote denial of service when a client opens and immediately closes a TCP connection, which can trigger an ENOTCONN or related errors in accept. Affected product: pyftpdli...

CVE-2007-6740

The ftpSTOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command...