CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-46483
https://notcve.org/view.php?id=CVE-2024-46483
22 Oct 2024 — Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content. • https://github.com/kn32/cve-2024-46483 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0737 – Xlightftpd Xlight FTP Server Login denial of service
https://notcve.org/view.php?id=CVE-2024-0737
19 Jan 2024 — A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://packetstormsecurity.com/files/176553/LightFTP-1.1-Denial-Of-Service.html • CWE-404: Improper Resource Shutdown or Release •
CVSS: 8.1EPSS: 17%CPEs: 1EXPL: 4CVE-2022-28998
https://notcve.org/view.php?id=CVE-2022-28998
23 May 2022 — Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted code. Se ha detectado que Xlight FTP versión v3.9.3.2, contiene un desbordamiento de búfer en la región stack de la memoria que permite a atacantes filtrar información confidencial por medio de código diseñado • https://i.imgur.com/aw6hZo2.png • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2695
https://notcve.org/view.php?id=CVE-2010-2695
12 Jul 2010 — Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3) rename, and other unspecified commands. Vulnerabilidad de salto de directorio en SFTP/SSH2 virtual server en Xlight FTP Server v3.5.0, v3.5.5, y posiblemente otras versiones anteriores a v3.6 permite a atacantes remotos autenticados leer,... • http://osvdb.org/66037 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 33EXPL: 3CVE-2009-4795 – Xlight FTP Server 3.2 - 'user' SQL Injection
https://notcve.org/view.php?id=CVE-2009-4795
22 Apr 2010 — Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command. Multiples vulnerabilidades de inyección SQL en Xlight FTP Server en versiones anteriores a la v3.2.1, cuando la autenticación ODBC está activada, permite a los usuarios remotos autenticados ejecutar comandos de su elección SQL a través del comando (1) USER (también conocido c... • https://www.exploit-db.com/exploits/32877 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •