g.rodola pyftpdlib vulnerabilities and exploits

(subscribe to this query)

ftpserver.py in pyftpdlib prior to 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.4.0 G.rodola Pyftpdlib 0.5.0 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.1.1

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib prior to 0.5.2 allows remote malicious users to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value o...

G.rodola Pyftpdlib 0.4.0 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib 0.1.1 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.5.0

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib prior to 0.5.2 allows remote malicious users to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN erro...

G.rodola Pyftpdlib 0.4.0 G.rodola Pyftpdlib 0.1.1 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.5.0 G.rodola Pyftpdlib 0.3.0

Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib prior to 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer.

G.rodola Pyftpdlib 0.1.1 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.5.0 G.rodola Pyftpdlib 0.4.0 G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.1

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib prior to 0.5.1 allows remote malicious users to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return ...

G.rodola Pyftpdlib 0.4.0 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.1.1

The ftp_QUIT function in ftpserver.py in pyftpdlib prior to 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.

G.rodola Pyftpdlib G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.1.1

ftpserver.py in pyftpdlib prior to 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote malicious users to obtain access via a brute-force attack.

G.rodola Pyftpdlib 0.1.1 G.rodola Pyftpdlib G.rodola Pyftpdlib 0.3.0 G.rodola Pyftpdlib 0.2.0 G.rodola Pyftpdlib 0.1

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib prior to 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a (1) CWD, (2) DELE, (3) STOR, or (4) RETR command.

G.rodola Pyftpdlib 0.1.1 G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib

FTPServer.py in pyftpdlib prior to 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote malicious users to obtain access via a brute-force attack.

G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib

The ftp_PORT function in FTPServer.py in pyftpdlib prior to 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bo...

G.rodola Pyftpdlib 0.1 G.rodola Pyftpdlib

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook