8 results · Feed
-
High 7.4
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a tic…
-
Low 3.1
vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can …
-
Unscored —
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protoco…
-
Unscored —
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown…
-
Unscored —
net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cl…
-
Unscored —
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a den…
-
Unscored —
vsftpd before 1.2.2, when under heavy load, allows attackers to cause a denial of service (crash) via a SIGCHLD signal …
-
Unscored —
vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remot…