Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
155 results · page 2 of 4
Feb 14, 2022Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords.CVE-2022-24110 · Other software · Accellion · reported by MITREMedium 6.5
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.
- Product
- Managed File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkiteworks.com
Jan 18, 2022NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due toCVE-2022-23083 · Other software · Broadcom · reported by vuln@ca.comMedium 6.1
NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due to insufficient input validation that could potentially allow an attacker to execute code on the affected machine.
- Product
- Netmaster File Transfer Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Oct 26, 2021An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer mCVE-2020-7867 · Other software · HelpU · reported by vuln@krcert.or.krHigh 8
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of administrator.
- Product
- HelpuViewer.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2021Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which allows attackers to exCVE-2020-36502 · Other software · Swiftfiletransfer · reported by MITREMedium 6.1
Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered as the device name itself.
- Product
- Swift File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'dowCVE-2020-36486 · Other software · Swiftfiletransfer · reported by MITREMedium 6.1
Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.
- Product
- Swift File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter.CVE-2020-23038 · Other software · Kumilabs · reported by MITREHigh 7.5
Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables.
- Product
- Swift File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Aug 5, 2021A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page.CVE-2020-7863 · Other software · Raonwiz,inc · reported by vuln@krcert.or.krHigh 8.8
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
- Product
- RAON K Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2021Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute aCVE-2021-27649 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Apr 19, 2021Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and CVE-2020-7851 · Other software · INNORIX · reported by vuln@krcert.or.krHigh 7.8
Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
- Product
- INNORIX Agent.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinnorix.comkrcert.or.kr
Nov 25, 2020A flaw was found in the SPICE file transfer protocol.CVE-2020-25651 · Other software · Spice-space · reported by Red HatMedium 6.4
A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.
- Product
- Spice-vdagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Nov 25, 2020A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.CVE-2020-25650 · Other software · Spice-space · reported by Red HatMedium 5.5
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.
- Product
- Spice-vdagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Oct 22, 2020Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.CVE-2020-27646 · Other software · Biscom · reported by MITREMedium 6.5
Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.biscom.comcve.biscom.com
Oct 5, 2020A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers.CVE-2020-25636 · Other software · AWS Community · reported by Red HatMedium 6.6
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
- Product
- Community Collections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jun 30, 2020The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vCVE-2020-9414 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
- Product
- TIBCO Managed File Transfer Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO ManagCVE-2020-9413 · Other software · TIBCO Software Inc. · reported by security@tibco.comMedium 6.3
The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
- Product
- TIBCO Managed File Transfer Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows exCVE-2020-9412 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 10
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.
- Product
- TIBCO Managed File Transfer Platform Server for IBM i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows anCVE-2020-9411 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 10
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.
- Product
- TIBCO Managed File Transfer Platform Server for IBM i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('CommanCVE-2019-5623 · Other software · Accellion · reported by cve@rapid7.comCritical 9.8
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.CVE-2019-5622 · Other software · Accellion · reported by cve@rapid7.comCritical 9.8
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2020DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.CVE-2020-12128 · Other software · File Transfer Ifamily Project · reported by MITREHigh 7.5
DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.
- Product
- File Transfer Ifamily
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Mar 18, 2020SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality viaCVE-2019-12769 · Other software · Solarwinds · reported by MITREHigh 8.8
SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters.
- Product
- Serv-u Managed File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comsupport.solarwinds.com
Feb 7, 2020Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.CVE-2020-8796 · Other software · Biscom · reported by MITRECritical 9.8
Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.biscom.comexchange.xforce.ibmcloud.com
Jan 31, 2020Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated senCVE-2020-8503 · Other software · Biscom · reported by MITREMedium 6.5
Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender because of an error in a file-upload feature. This is fixed in 5.1.1068 and 6.0.1004.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.biscom.comcve.biscom.com
Dec 17, 2019In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening CVE-2019-18257 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening on the TCP port. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running DiagAnywhere Server.
- Product
- Diaganywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
May 6, 2019All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.CVE-2019-10249 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgHigh 8.1
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
- Product
- Eclipse Xtext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orggithub.com
Mar 8, 2019UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service CVE-2019-8276 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comHigh 7.5
UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS). This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
- Product
- UltraVNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comics-cert.kaspersky.com
Mar 8, 2019UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execCVE-2019-8274 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comCritical 9.8
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
- Product
- UltraVNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comics-cert.kaspersky.com
Mar 8, 2019UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code exCVE-2019-8273 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comCritical 9.8
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
- Product
- UltraVNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comics-cert.kaspersky.com
Mar 8, 2019UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution.CVE-2019-8271 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comCritical 9.8
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
- Product
- UltraVNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comics-cert.kaspersky.com
Jan 21, 2019In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with CVE-2019-6500 · Other software · Axway · reported by MITREHigh 7.5
In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
- Product
- File Tranfer Direct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominf0seq.github.io
Jan 16, 2019Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server).CVE-2019-2538 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server). Supported versions that are affected are 19.1.0.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Managed File Transfer accessible data as well as unauthorized read access to a subset of Oracle Managed File Transfer accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Managed File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Dec 19, 2018LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can resuCVE-2018-6307 · Other software · Libvnc Project · reported by vulnerability@kaspersky.comHigh 8.1
LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.
- Product
- Libvncserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comlists.debian.org
Dec 19, 2018LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can CVE-2018-15127 · Other software · Libvnc Project · reported by vulnerability@kaspersky.comCritical 9.8
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution
- Product
- Libvncserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comics-cert.kaspersky.com
Dec 19, 2018LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can resuCVE-2018-15126 · Other software · Libvnc Project · reported by vulnerability@kaspersky.comCritical 9.8
LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution
- Product
- Libvncserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comlists.debian.org
Dec 11, 2018The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Managed File Transfer Internet Server containCVE-2018-18810 · Other software · TIBCO Software Inc. · reported by security@tibco.comMedium 6.8
The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Managed File Transfer Internet Server contains vulnerabilities where an authenticated user with specific privileges can gain access to credentials to other systems. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions up to and including 7.3.2; 8.0.0; 8.0.1; 8.0.2; 8.1.0, and TIBCO Managed File Transfer Internet Server: versions up to and including 7.3.2; 8.0.0; 8.0.1; 8.0.2; 8.1.0.
- Product
- TIBCO Managed File Transfer Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2018A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server Denial of Service VulCVE-2018-8206 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 25, 2018Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticaCVE-2016-10710 · Other software · Biscom · reported by MITREHigh 8.1
Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthreat.tevora.comthreat.tevora.com
Jan 4, 2018IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates.CVE-2017-1699 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates. A local attacker could exploit this vulnerability to modify or delete data contained in the files with an unknown impact. IBM X-Force ID: 134391.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Dec 19, 2017SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makeCVE-2017-17763 · Other software · Liveqos · reported by MITREHigh 7.5
SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection.
- Product
- Superbeam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthinktanksec.github.iothinktanksec.github.io
Oct 30, 2017ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer pluginCVE-2014-0072 · Websites & servers · Apache · reported by Red HatHigh 7.5
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
- Product
- Cordova File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd3adend.orgseclists.org
Oct 17, 2017Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 thatCVE-2017-5531 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8
Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative control of Managed File Transfer web applications.
- Product
- TIBCO Managed File Transfer Command Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtibco.com
Oct 10, 2017Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackCVE-2015-2856 · Other software · Accellion · reported by cret@cert.orgHigh 7.5
Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie.
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2017Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.CVE-2015-2857 · Other software · Accellion · reported by cret@cert.orgCritical 9.8
Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comrapid7.com
Aug 21, 2017In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software.CVE-2017-12784 · Other software · Ccfile · reported by MITREHigh 7.5
In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malformed request header with many '|' characters. NOTE: some sources use this ID for a NoviWare issue, but the correct ID for that issue is CVE-2017-12787.
- Product
- CC File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 18, 2017Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field.CVE-2017-5247 · Other software · Biscom · reported by cve@rapid7.comMedium 5.4
Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The resulting script will evaluated by any other authenticated user who views the attacker-supplied file name. All versions of SFT prior to 5.1.1028 are affected. The fix version is 5.1.1028.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.biscom.comtwitter.com
Jul 18, 2017Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field.CVE-2017-5246 · Other software · Biscom · reported by cve@rapid7.comMedium 4.3
Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}). This expression will be evaluated by any other authenticated user who views the attacker's display name. Affected versions are 5.0.0000 through 5.1.1026. The Issue is fixed in 5.1.1028.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.biscom.comtwitter.com
Jul 17, 2017Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web SCVE-2017-2240 · Other software · Hammock Corporation · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web Service".
- Product
- AssetView for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2017Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "DescCVE-2017-5241 · Other software · Biscom · reported by cve@rapid7.comMedium 5.4
Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.
- Product
- Secure File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.rapid7.com
May 5, 2017An issue was discovered on Accellion FTA devices before FTA_9_12_180.CVE-2017-8796 · Other software · Accellion · reported by MITRECritical 9.8
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php allows SQL injection with the app_id parameter.
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 5, 2017An issue was discovered on Accellion FTA devices before FTA_9_12_180.CVE-2017-8795 · Other software · Accellion · reported by MITREMedium 6.1
An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter.
- Product
- File Transfer Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.