CVSS: 9.1EPSS: 2%CPEs: 1EXPL: 0CVE-2006-6171
https://notcve.org/view.php?id=CVE-2006-6171
30 Nov 2006 — ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so ... • http://proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?r1=1.292&r2=1.293&sortby=date •
CVSS: 10.0EPSS: 57%CPEs: 1EXPL: 2CVE-2006-5815 – ProFTPd 1.2 < 1.3.0 (Linux) - 'sreplace' Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-5815
08 Nov 2006 — Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit." Desbordamiento de búfer basado en pila en la función sreplace en ProFTPD 1.3.0 y anteriores permite a atacantes remotos, probablemente autentificados, provocar denegación de servicio y ejecutar código de su elección, como se demostró con vd_proftpd.pm, un "explo... • https://www.exploit-db.com/exploits/16852 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 7%CPEs: 37EXPL: 0CVE-2005-4816
https://notcve.org/view.php?id=CVE-2005-4816
31 Dec 2005 — Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password. • http://archives.neohapsis.com/archives/dailydave/2006-q1/0122.html •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 0CVE-2005-2390
https://notcve.org/view.php?id=CVE-2005-2390
27 Jul 2005 — Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive. Múltiples vulnerabilidades de formateo de cadenas en ProFTPD anterior a la 1..3.0rc2 permite que atacantes causen una denegación de servicio u obtengan información confidencial mediante: 1) ciertos inputs al mensaje de apagado de ftpshut o 2) la directiva SQLShowInf... • http://marc.info/?l=bugtraq&m=112604373503912&w=2 •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 4CVE-2004-1602 – ProFTPd 1.2.10 - Remote Users Enumeration
https://notcve.org/view.php?id=CVE-2004-1602
15 Oct 2004 — ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response. • https://www.exploit-db.com/exploits/581 • CWE-203: Observable Discrepancy •
CVSS: 9.1EPSS: 0%CPEs: 11EXPL: 0CVE-2004-0432
https://notcve.org/view.php?id=CVE-2004-0432
05 May 2004 — ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions. ProFTPD 1.2.9 trata las directivas Permitir y Denegar para ACLS basadas en CIDR como si fueran AllowAll (Permitir Todo), lo que podría permitir a clientes FTP saltarse las restricciones de acceso pretendidas. • http://bugs.proftpd.org/show_bug.cgi?id=2267 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2004-0346
https://notcve.org/view.php?id=CVE-2004-0346
18 Mar 2004 — Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command. • http://marc.info/?l=bugtraq&m=107824679817240&w=2 • CWE-193: Off-by-one Error •
CVSS: 9.8EPSS: 18%CPEs: 9EXPL: 3CVE-2003-0831 – ProFTPd 1.2.7/1.2.8 - '.ASCII' File Transfer Buffer Overrun
https://notcve.org/view.php?id=CVE-2003-0831
25 Sep 2003 — ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files. ProFTPD 1.2.7 a 1.2.9rc2 no traduce adecuadamente los caractéres de nueva línea cuando transfiere caractéres en modo ASCII, permite a atancantes remotos ejecutar código arbitrario mediante un desbordamiento de búfer usando ciertos ficheros. • https://www.exploit-db.com/exploits/23170 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 17EXPL: 0CVE-2001-1500
https://notcve.org/view.php?id=CVE-2001-1500
31 Dec 2001 — ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000450 •