Total
25 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-40048 | 1 Progress | 1 Ws Ftp Server | 2023-09-27 | N/A | 6.5 MEDIUM |
| In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function. | |||||
| CVE-2023-40047 | 1 Progress | 1 Ws Ftp Server | 2023-09-27 | N/A | 4.8 MEDIUM |
| In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads. Once the cross-site scripting payload is successfully stored, an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser. | |||||
| CVE-2023-40046 | 1 Progress | 1 Ws Ftp Server | 2023-09-27 | N/A | 7.2 HIGH |
| In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. | |||||
| CVE-2023-40045 | 1 Progress | 1 Ws Ftp Server | 2023-09-27 | N/A | 6.1 MEDIUM |
| In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser. | |||||
| CVE-2023-24029 | 1 Progress | 1 Ws Ftp Server | 2023-02-12 | N/A | 7.2 HIGH |
| In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows. | |||||