PR
Product
ProFTPD
21
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 1Low 0
Watch
Add ProFTPD to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35025 | 8.1 | Jun 24 | ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR Affected: through 1.3.9b; through 1.3.10rc2 |
| CVE-2026-53994 | 6.5 | Jul 18 | ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation Affected: before 1.3.10 |
| CVE-2009-0542 | – | Feb 12 | SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which… Affected: 1.3.1; 1.3.2; 1.3.2_rc2 |
| CVE-2008-4242 | – | Sep 25 | ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute… Affected: 1.3.1 |
| CVE-2007-2165 | – | Apr 22 | The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same… Affected: through 1.3.0_rc1 |
| CVE-2006-6563 | – | Dec 15 | Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a… Affected: 1.3.0; 1.3.0a |
| CVE-2006-6171 | – | Nov 30 | ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow Affected: through 1.3.0a |
| CVE-2006-6170 | – | Nov 30 | Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute… Affected: through 1.3.0a |
| CVE-2006-5815 | – | Nov 8 | Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute… Affected: through 1.3.0 |
| CVE-2005-4816 | – | Dec 31 | Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password Affected: 1.2; 1.2.0_rc1; 1.2.0_rc2; 1.2.0_rc3; 1.2.1; 1.2.2; +31 more |
| CVE-2005-2390 | – | Jul 27 | Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the… Affected: 1.2.0_pre9; 1.2.0_pre10; 1.2.0_rc1; 1.2.0_rc2; 1.2.0_rc3; 1.2.1; +31 more |
| CVE-2004-0432 | – | Aug 18 | ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions Affected: 1.2.9 |
| CVE-2003-0831 | – | Nov 17 | ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a… Affected: 1.2.7; 1.2.7_rc1; 1.2.7_rc2; 1.2.7_rc3; 1.2.8; 1.2.8_rc1; +3 more |
| CVE-2003-0500 | – | Aug 7 | SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain… Affected: 1.2.9_rc1 |
| CVE-2001-1501 | – | Dec 31 | The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large… Affected: 1.2.1 |
| CVE-2001-1500 | – | Dec 31 | ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs… Affected: 1.2; 1.2.0_rc3; 1.2.1; 1.2.2; 1.2.2_rc1; 1.2.2_rc2; +11 more |
| CVE-2001-0318 | – | Jun 2 | Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd) Affected: 1.2.0_rc2 |
| CVE-2001-0027 | – | Feb 12 | mod_sqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of… Affected: All versions, or not specified |
| CVE-1999-1475 | – | Nov 19 | ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp,… Affected: 1.2 |
| CVE-1999-0911 | – | Aug 27 | Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories Affected: 1.2_pre1; 1.2_pre2; 1.2_pre3; 1.2_pre4; 1.2_pre5 |
| CVE-1999-0368 | – | Feb 9 | Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a Affected: 1.2_pre1 |
Showing 21