Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Advisory: Progress Software WS_FTP Server — community.progress.com/s/article/WS-FTP-Server-Critical-Vul… Clear all filters
TI-2023-20939 CVE-2023-40049 · GHSA-3c55-6x27-8w5g

WS_FTP Server Information Disclosure via Directory Listing

Priority LOW 32

In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00888 Published 2023-09-27 Fixed in 8.8.2 CWE-200
TI-2023-20938 CVE-2023-40048 · GHSA-hrhv-m8m9-xcpx

WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability

Priority LOW 30

In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00406 Published 2023-09-27 Fixed in 8.8.2 CWE-352
TI-2023-20937 CVE-2023-40047 · GHSA-5829-ch6w-2w9q

WS_FTP Server Stored Cross-Site Scripting Vulnerability

Priority LOW 38

In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00414 Published 2023-09-27 Fixed in 8.8.2 CWE-79
TI-2023-20936 CVE-2023-40046 · GHSA-m857-4vjp-6jvc

WS_FTP Server SQL Injection via Administrative Interface

Priority LOW 38

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface.

CVSS 3.1HIGH 8.2 Network High privileges No interaction EPSS 0.01009 Published 2023-09-27 Fixed in 8.8.2, 8.7.4 CWE-89
TI-2023-22761 CVE-2023-42657 · GHSA-vrp3-qmw4-rx8c

WS_FTP Server Directory Traversal

Priority MEDIUM 59

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.16008 Published 2023-09-27 Fixed in 8.8.2, 8.7.4 CWE-22
TI-2023-20934 CVE-2023-40044 · GHSA-29vf-j74g-gmfc

WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

Priority CRITICAL 100KEV

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Serve…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.90355 Published 2023-09-27 Fixed in 8.8.2, 8.7.4 CWE-502