CVE-2010-3494

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

CVE-2007-6736

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. dot dot in a 1 LIST, 2 STOR, or 3 RETR command...

CVE-2007-6740

The ftpSTOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command...

CVE-2009-5011

The CVE-2009-5011 entry refers to a race condition in pyftpdlib’s FTPHandler (ftpserver.py) prior to version 0.5.2, causing a remote denial of service when a client opens and immediately closes a TCP connection, which can trigger an ENOTCONN or related errors in accept. Affected product: pyftpdli...

CVE-2007-6741

CVE-2007-6741 affects the pyftpdlib FTP server: the FTPServer.py ftp_PORT function before version 0.2.0 does not block TCP connections to privileged ports when the destination IP matches the connection’s source IP, enabling potential FTP bounce attacks against NATs by remote authenticated users. ...

CVE-2007-6737

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attemptedlogins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2007-6739

FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command...

CVE-2009-5012

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session...

CVE-2008-7263

The CVE-2008-7263 entry affects the pyftpdlib FTP server (ftpserver.py) prior to version 0.5.0. The root issue is that it does not delay its response after an invalid login attempt, which makes brute-force access easier for remote attackers. The provided connected documents confirm the affected c...

CVE-2008-7264

CVE-2008-7264 : The ftp_QUIT function in ftpserver.py of pyftpdlib (before 0.5.0) allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by issuing QUIT during a disallowed data-transfer attempt. This is the explicit vulnerability description...

CVE-2007-6738

CVE-2007-6738 affects pyftpdlib prior to 0.1.1. The PASV command uses a non-random port value, enabling remote attackers to infer the number of in‑progress data connections by reading the response. Impact is information disclosure. Mitigation: upgrade to 0.1.1 or later (per the cited descriptions...

CVE-2009-5010

CVE-2009-5010 affects pyftpdlib’s FTPHandler in ftpserver.py. A race condition allows a remote attacker to trigger a denial of service by opening and immediately closing a TCP connection, causing accept to receive an unexpected value (None or similar). Impact is partial availability degradation o...

CVE-2010-3494

CVE-2010-3494 describes a race condition in the FTPHandler class of ftpserver.py in pyftpdlib before 0.5.2. The vulnerability allows a remote attacker to trigger a denial of service (daemon outage) by opening and immediately closing a TCP connection, causing the accept() call to see an unexpected...

CVE-2007-6737

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attemptedlogins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2008-7262

CVE-2008-7262 concerns pyftpdlib’s FTPServer.py (pre-0.3.0) where multiple directory traversal flaws allow remote authenticated users to access arbitrary files/directories via a symlink-in-pathname in CWD, DELE, STOR, or RETR commands. The vulnerability is triggered by crafted pathnames containin...

CVE-2007-6741

The ftpPORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via...

CVE-2007-6736

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. dot dot in a 1 LIST, 2 STOR, or 3 RETR command...

CVE-2009-5011

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN error, a different vulnerabilit...