CVE-2009-4648

CVE-2009-4648 affects Accellion Secure File Transfer Appliance before 8_0_105. Root cause: access to sensitive commands run with extra sudo privileges is not properly restricted in /usr/local/bin/admin.pl, enabling local administrators to escalate privileges. Vulnerability vectors include (1) arb...

CVE-2009-4647

Affected product: Accellion Secure File Transfer Appliance. Vulnerability: Cross-site scripting (XSS) via the username parameter when the administrator views audit logs. Impact: remote attacker can inject arbitrary web script/HTML into the admin context. Root cause: improper handling of the usern...

CVE-2009-4644

The CVE-2009-4644 issue affects the Accellion Secure File Transfer Appliance, specifically versions prior to 8_0_105. It allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands by injecting shell metacharacters via the cli program (demonstrated wit...

CVE-2009-4645

CVE-2009-4645 affects Accellion Secure File Transfer Appliance (SFTA) before version 8_0_105. The issue is a directory traversal in web_client_user_guide.html triggered by a .. (dot dot) in the lang parameter, allowing remote attackers to read arbitrary files. The connected documents confirm the ...