core ftp vulnerabilities and exploits

(subscribe to this query)

NA

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Haxx Curl Netapp Element Software -Netapp Clustered Data Ontap -Netapp Solidfire -Netapp Hci Management Node -Netapp Bootstrap Os -Netapp H300s Firmware -Netapp H500s Firmware -Netapp H700s Firmware -Netapp H410s Firmware -Apple Macos Debian Debian Linux 10.0 Splunk Universal Forwarder 9.1.0 Splunk Universal Forwarder

7.5

CVSSv2

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the t...

Haxx Curl Fedoraproject Fedora 35 Debian Debian Linux 11.0 Netapp Element Software -Netapp Clustered Data Ontap -Netapp Solidfire -Netapp Hci Management Node -Netapp Bootstrap Os -Netapp H300s Firmware -Netapp H500s Firmware -Netapp H700s Firmware -Netapp H410s Firmware -Apple Macos Splunk Universal Forwarder 9.1.0 Splunk Universal Forwarder

4.3

CVSSv2

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Haxx Curl Fedoraproject Fedora 35 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Element Software -Netapp Clustered Data Ontap -Netapp Solidfire -Netapp Hci Management Node -Netapp Bootstrap Os -Netapp H300s Firmware -Netapp H500s Firmware -Netapp H700s Firmware -Netapp H410s Firmware -Apple Macos Splunk Universal Forwarder 9.1.0 Splunk Universal Forwarder

2.6

CVSSv2

Core FTP / SFTP Server v2 Build 725 exists to allow unauthenticated malicious users to cause a Denial of Service (DoS) via a crafted packet through the SSH service.

Coreftp Core Ftp 2.0

4

CVSSv2

CoreFTP Server prior to 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

Coreftp Core Ftp Coreftp Core Ftp 2.0

4.3

CVSSv2

Apache Log4j2 versions 2.0-alpha1 up to and including 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted strin...

74 Github repositories5 Articles

5

CVSSv2

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be byp...

2 Github repositories

4.3

CVSSv2

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of ca...

2 Github repositories1 Article

5

CVSSv2

Buffer overflow vulnerability in Core FTP Server v2 Build 697, via a crafted username.

Coreftp Core Ftp 2.0

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook