Provideserver Provide FTP Server
8 CVEs affecting Provideserver Provide FTP Server. Latest disclosed: 2020-04-12. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11708 | Critical | 9.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of t… |
CVE-2020-11705 | Critical | 9.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. /ajax/ImportCertificate allows an attacker to load an arbitrary certificate in .pfx form… |
CVE-2020-11707 | High | 8.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. It doesn't enforce permission over Windows Symlinks or Junctions. As a result, a low-pri… |
CVE-2020-11706 | High | 8.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Interface allows CSRF for actions such as: Change any username and password, a… |
CVE-2020-11701 | High | 8.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. CSRF exists in the User Web Interface, as demonstrated by granting filesystem access to… |
CVE-2020-11703 | High | 7.5 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. /ajax/GetInheritedProperties allows HTTP Response Splitting via the language parameter. |
CVE-2020-11704 | Medium | 6.1 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is… |
CVE-2020-11702 | Medium | 6.1 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Refl… |