CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-27665
https://notcve.org/view.php?id=CVE-2022-27665
Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. • https://github.com/dievus/CVE-2022-27665 https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24029
https://notcve.org/view.php?id=CVE-2023-24029
In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows. • https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-January-2023?popup=true https://www.progress.com/ws_ftp • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12146
https://notcve.org/view.php?id=CVE-2019-12146
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory. Fue descubierto un problema de cruces de directorios en SSHServerAPI.dll en Progress ipswithc WS_FTP Server 2018 anterior 8.6.1. los atacantes tienen la habilidad para abusar de un defecto en el oyente SCP, mediante la creación de cadenas utilizando patrones específicos para escribir archivos y crear directorios fuera de su directorio autorizado • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12145
https://notcve.org/view.php?id=CVE-2019-12145
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system. Se descubrió un problema de cruce de directorios en SSHServerAPI.dll en progreso ipswitch WS_FTP Server 2018 anterior de 8.6.1. Un atacante puede suministrar una cadena utilizando patrones especiales a través del protocolo SCP para revelar nombres de ruta en el sistema operativo host • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12144
https://notcve.org/view.php?id=CVE-2019-12144
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature. Un problema fue descubierto en SSHServerAPI.dll en Progress ipswitch WS_FTP Server 2018 anterior 8.6.1. los atacantes tienen la habilidad para abusar de una vulnerabilidad de un giro de ruta usando el protocolo SCP, los atacantes que puedan liberar este defecto, podrían además, obtener una ejecución de código remoto haciendo una carga útil que abusa que abusa de la función de comando SITE. • https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •