CVSS: 10.0EPSS: 92%CPEs: 2EXPL: 4CVE-2023-40044 – Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2023-40044
27 Sep 2023 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. En las versiones del servidor WS_FTP anteriores a la 8.7.4 y 8.8.2, un atacante previamente autenticado podría aprovechar una vulnerabilidad de deserialización de .NET en el módulo Ad Hoc Transfer para ejecutar comandos remotos en el sistema operativo subyacente del servi... • https://packetstorm.news/files/id/174917 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24029
https://notcve.org/view.php?id=CVE-2023-24029
03 Feb 2023 — In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows. • https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-January-2023?popup=true • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12146
https://notcve.org/view.php?id=CVE-2019-12146
11 Jun 2019 — A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory. Fue descubierto un problema de cruces de directorios en SSHServerAPI.dll en Progress ipswithc WS_FTP Server 2018 anterior 8.6.1. los atacantes tienen la habilidad para abusar de un defecto en el oyente SCP, medi... • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12145
https://notcve.org/view.php?id=CVE-2019-12145
11 Jun 2019 — A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system. Se descubrió un problema de cruce de directorios en SSHServerAPI.dll en progreso ipswitch WS_FTP Server 2018 anterior de 8.6.1. Un atacante puede suministrar una cadena utilizando patrones especiales a través del protocolo SCP para revelar nombres de ruta en el sist... • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12144
https://notcve.org/view.php?id=CVE-2019-12144
11 Jun 2019 — An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature. Un problema fue descubierto en SSHServerAPI.dll en Progress ipswitch WS_FTP Server 2018 anterior 8.6.1. los atacantes tienen la habilidad para abusar de una vulnerabilidad de un giro de ruta... • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12143
https://notcve.org/view.php?id=CVE-2019-12143
11 Jun 2019 — A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WS_FTP usernames as well as filenames. Fue descubierto un problema de cruce de directorios en SSHSeverAPI.dll en Progress Ipswitch WS_FTP Server 2018 anterior 8.6.1. un atacante puede suministrar una cadena usando patrones especiales mediante el protocolo SCP para revelar nombres de usuario así como nombre... • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 43%CPEs: 4EXPL: 0CVE-2006-5001
https://notcve.org/view.php?id=CVE-2006-5001
26 Sep 2006 — Unspecified vulnerability in the log analyzer in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, prevents certain sensitive information from being displayed in the (1) Files and (2) Summary tabs. NOTE: in the early publication of this identifier on 20060926, the description was used for the wrong issue. Vulnerabilidad no especificada en el analizador de log en WS_FTP Server 5.05 anterior a Hotfix 1, y posiblemente versiones anteriores a la 5.0, previene que cierta información se... • http://www.ipswitch.com/support/ws_ftp-server/releases/wr505hf1.asp •
CVSS: 8.8EPSS: 90%CPEs: 27EXPL: 2CVE-2006-4847 – Ipswitch WS_FTP Server 5.05 - XMD5 Overflow
https://notcve.org/view.php?id=CVE-2006-4847
19 Sep 2006 — Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA1, or (3) XMD5 commands. Múltiples desbordamientos de búfer en Ipswitch WS_FTP Server 5.05 anterior al Hotfix 1 permiten a usuarios autenticados remotamente ejecutar código de su elección a través de comandos largos (1) XCRC, (2) XSHA1, o (3) XMD5. • https://www.exploit-db.com/exploits/16717 •
CVSS: 7.5EPSS: 3%CPEs: 20EXPL: 3CVE-2004-1848
https://notcve.org/view.php?id=CVE-2004-1848
31 Dec 2004 — Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size argument, followed by a STOR of a smaller file. • http://marc.info/?l=bugtraq&m=108006717731989&w=2 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 24EXPL: 2CVE-2004-1884
https://notcve.org/view.php?id=CVE-2004-1884
23 Mar 2004 — Ipswitch WS_FTP Server 4.0.2 has a backdoor XXSESS_MGRYY username with a default password, which allows remote attackers to gain access. • http://marc.info/?l=bugtraq&m=108006581418116&w=2 •