CVSS: 7.5EPSS: 4%CPEs: 1EXPL: 0CVE-2014-5211 – Attachmate Reflection FTP Client Stack Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-5211
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response. Desbordamiento de buffer basado en pila en el cliente FTP Attachmate Reflection anterior a 14.1.433 permite a servidores FTP remotos ejecutar código arbitrario a través de una respuesta PWD grande. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Attachmate Reflection FTP client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw manifests while parsing the response to a PWD command. The client copies part of the response to a fixed-length stack buffer. • http://secunia.com/advisories/62467 http://support.attachmate.com/techdocs/1708.html http://support.attachmate.com/techdocs/2288.html http://support.attachmate.com/techdocs/2501.html http://support.attachmate.com/techdocs/2502.html http://www.zerodayinitiative.com/advisories/ZDI-15-008 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 77%CPEs: 1EXPL: 0CVE-2014-0603 – Attachmate Reflection Pro FTP rftpcom15.dll GetSiteProperties3 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-0603
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address. NOTE: this issue was MERGED with CVE-2014-0606 because it is the same type of vulnerability, affecting the same set of versions, and discovered by the same researcher. El control rftpcom.dll de ActiveX en Attachmate Reflection FTP Client anterior a 14.1.429 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria) y ejecutar código arbitrario a través de vectores relacionados con los métodos (1) GetGlobalSettings o (2) GetSiteProperties3, lo que provoca una referencia de una dirección de memoria arbitraria. NOTA: este problema fue fusionado (MERGED) con CVE-2014-0606 porque se trata del mismo tipo de vulnerabilidad, que afecta el mismo juego de versiones y que fue descubierto por el mismo investigador. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Attachmate Reflection Pro FTP. • http://support.attachmate.com/techdocs/2501.html http://www.zerodayinitiative.com/advisories/ZDI-14-288 http://www.zerodayinitiative.com/advisories/ZDI-14-291 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 49%CPEs: 1EXPL: 0CVE-2014-0604 – Attachmate Reflection Secure FTP Client rftpcom.dll StartLog Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-0604
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method. Vulnerabilidad de salto de directorio en el control rftpcom.dll de ActiveX en Attachmate Reflection FTP Client anterior a 14.1.429 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados en el método StartLog. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Attachmate Reflection Secure FTP Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Attachmate Reflection Secure FTP Client ActiveX control StartLog method which suffers from a directory traversal flaw. An attacker can exploit this condition to achieve code execution under the context of the browsing user. • http://support.attachmate.com/techdocs/2501.html http://www.zerodayinitiative.com/advisories/ZDI-14-289 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 49%CPEs: 1EXPL: 0CVE-2014-0605 – Attachmate Reflection Secure FTP Client rftpcom.dll SaveSettings Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-0605
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method. Vulnerabilidad de salto de directorio en el control rftpcom.dll de ActiveX en Attachmate Reflection FTP Client anterior a 14.1.429 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados en el método SaveSettings. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Attachmate Reflection Secure FTP Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Attachmate Reflection Secure FTP Client ActiveX control SaveSettings method which suffers from a directory traversal flaw. An attacker can exploit this condition to achieve code execution under the context of the browsing user. • http://support.attachmate.com/techdocs/2501.html http://www.zerodayinitiative.com/advisories/ZDI-14-290 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 7%CPEs: 2EXPL: 0CVE-2014-0607 – Attachmate Verastream Process Designer Process Server Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-0607
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file. Vulnerabilidad de subida de ficheros sin restricciones en Attachmate Verastream Process Designer (VPD) anterior a R6 SP1 Hotfix 1 permite a atacantes remotos ejecutar código arbitrario mediante la subida y el lanzamiento de un fichero ejecutable. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Attachmate Verastream Process Designer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the 'DeploymentService' Axis web service. This web service is not protected by authentication requirements and suffers from a directory traversal vulnerability. • http://support.attachmate.com/techdocs/2700.html •