Progress Ws_ftp_server
28 CVEs affecting Progress Ws_ftp_server. Latest disclosed: 2024-08-28. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40044 | Critical | 10.0 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer mod… |
CVE-2023-42657 | Critical | 9.9 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to pe… |
CVE-2023-42659 | Critical | 9.1 | 2023-11-07 | In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the abili… |
CVE-2023-40047 | High | 8.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with ad… |
CVE-2023-40045 | High | 8.3 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module… |
CVE-2023-40046 | High | 8.2 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able t… |
CVE-2024-1474 | High | 7.5 | 2024-02-21 | In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server adminis… |
CVE-2023-24029 | High | 7.2 | 2023-02-03 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient… |
CVE-2023-40048 | Medium | 6.8 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transactio… |
CVE-2024-7745 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the s… |
CVE-2024-7744 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web T… |
CVE-2022-27665 | Medium | 6.1 | 2023-04-03 | Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and comm… |
CVE-2023-40049 | Medium | 5.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. |
CVE-2019-12143 | Medium | 5.3 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using spec… |
CVE-2008-0590 | | 2008-02-05 | Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrar… | |
CVE-2006-5001 | | 2006-09-26 | Unspecified vulnerability in the log analyzer in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, prevents certain sensitive inform… | |
CVE-2006-5000 | | 2006-09-26 | Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, have unknown impact and remote authenticated attack v… | |
CVE-2006-4847 | | 2006-09-19 | Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA… | |
CVE-2004-1885 | | 2004-12-31 | Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc opti… | |
CVE-2004-1883 | | 2004-12-31 | Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be… |