CVSS: 9.0EPSS: 13%CPEs: 9EXPL: 3CVE-2003-0831 – ProFTPd 1.2.7/1.2.8 - '.ASCII' File Transfer Buffer Overrun
https://notcve.org/view.php?id=CVE-2003-0831
ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files. ProFTPD 1.2.7 a 1.2.9rc2 no traduce adecuadamente los caractéres de nueva línea cuando transfiere caractéres en modo ASCII, permite a atancantes remotos ejecutar código arbitrario mediante un desbordamiento de búfer usando ciertos ficheros. • https://www.exploit-db.com/exploits/23170 https://www.exploit-db.com/exploits/110 https://www.exploit-db.com/exploits/107 http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012072.html http://marc.info/?l=bugtraq&m=106441655617816&w=2 http://marc.info/?l=bugtraq&m=106606885611269&w=2 http://secunia.com/advisories/9829 http://www.kb.cert.org/vuls/id/405348 http://www.mandriva.com/security/advisories?name=MDKSA-2003:095 http://xforce.iss.net/xfo • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2003-0500 – ProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injection
https://notcve.org/view.php?id=CVE-2003-0500
SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name. Vulnerabilidad de inyección de SQL en el módulo de autenticación de PostgreSQL (mod_sql_postgress) de ProFTPD anteriores a 1.2.9rc1 permite a atacantes remotos ejecutar SLQ arbitrario y ganar privilegios saltándose la autenticación o robando contraseñas mediante nombre de usuario (comando USER). • https://www.exploit-db.com/exploits/43 http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005826.html http://www.debian.org/security/2003/dsa-338 •
CVSS: 5.0EPSS: 3%CPEs: 1EXPL: 1CVE-2001-1501 – WU-FTPD 2.4/2.5/2.6 / Trolltech ftpd 1.2 / ProFTPd 1.2 / BeroFTPD 1.3.4 FTP - glob Expansion
https://notcve.org/view.php?id=CVE-2001-1501
The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters, as demonstrated using an ls command with multiple (1) "*/..", (2) "*/.*", or (3) ".*./*?/" sequences in the argument. • https://www.exploit-db.com/exploits/20690 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000450 http://online.securityfocus.com/archive/1/169395 http://www.mandriva.com/security/advisories?name=MDKSA-2002:005 •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2001-1500
https://notcve.org/view.php?id=CVE-2001-1500
ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000450 http://www.mandriva.com/security/advisories?name=MDKSA-2002:005 http://www.securityfocus.com/archive/1/212805 http://www.securityfocus.com/bid/3310 https://exchange.xforce.ibmcloud.com/vulnerabilities/7126 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2001-0318
https://notcve.org/view.php?id=CVE-2001-0318
Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd). • http://archives.neohapsis.com/archives/bugtraq/2001-02/0117.html http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000380 http://marc.info/?l=bugtraq&m=97916525715657&w=2 http://www.debian.org/security/2001/dsa-029 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-021.php3 https://exchange.xforce.ibmcloud.com/vulnerabilities/6433 •