WS
Product
WS_FTP Server
On CISA KEVExploited in the wildRansomware-linked
28
CVEs
1
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 8Low 0
Watch
Add WS_FTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-40044 RansomwareIn wildKEV | 8.8 | Sep 27 | WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability Affected: before 8.7.4; 8.8 before 8.8.2 |
| CVE-2023-42657 | 9.6 | Sep 27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations… Affected: before 8.7.4; 8.8.0 before 8.8.2 |
| CVE-2023-42659 | 8.8 | Nov 7 | In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified Affected: before 8.7.6; 8.8.0 before 8.8.4 |
| CVE-2024-7745 | 8.1 | Aug 28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor… Affected: before 8.8.8 |
| CVE-2023-40046 | 7.2 | Sep 27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface Affected: before 8.7.4; 8.8 before 8.8.2 |
| CVE-2023-24029 | 7.2 | Feb 3 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization… Affected: before 8.8 |
| CVE-2024-7744 | 6.5 | Aug 28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module… Affected: before 8.8.8 |
| CVE-2023-40048 | 6.5 | Sep 27 | In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a… Affected: before 8.8.2 |
| CVE-2024-1474 | 6.1 | Feb 21 | In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface Affected: before 8.8.5 |
| CVE-2023-40045 | 6.1 | Sep 27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could… Affected: before 8.7.4; 8.8 before 8.8.2 |
| CVE-2022-27665 | 6.1 | Apr 3 | Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0 Affected: 8.6.0 |
| CVE-2023-40049 | 5.3 | Sep 27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing Affected: before 8.8.2 |
| CVE-2019-12143 | 5.3 | Jun 11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1 Affected: before 8.6.1 |
| CVE-2023-40047 | 4.8 | Sep 27 | In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module Affected: before 8.8.2 |
| CVE-2008-0590 | – | Feb 5 | Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long… Affected: 6.1.0.0 |
| CVE-2006-5001 | – | Sep 26 | Unspecified vulnerability in the log analyzer in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, prevents certain sensitive information from being… Affected: through 5.05; 5.0.2 |
| CVE-2006-5000 | – | Sep 26 | Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other versions down to 5.0, have unknown impact and remote authenticated attack vectors via the (1)… Affected: 5.0.2 |
| CVE-2006-4847 | – | Sep 19 | Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA1, or (3) XMD5… Affected: through 5.05; 1.0.1; 1.0.1.e; 1.0.2; 1.0.2.e; 1.0.3; +15 more |
| CVE-2004-1883 | – | Dec 31 | Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the… Affected: 4.0.2 |
| CVE-2004-1885 | – | Dec 31 | Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled… Affected: 4.0.2 |
| CVE-2004-1848 | – | Dec 31 | Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size… Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 2.0; +12 more |
| CVE-2004-1643 | – | Aug 29 | WS_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path with a "../" sequence Affected: 5.0.2 |
| CVE-2004-1884 | – | Mar 23 | Ipswitch WS_FTP Server 4.0.2 has a backdoor XXSESS_MGRYY username with a default password, which allows remote attackers to gain access Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 2.0; +12 more |
| CVE-2003-0772 | – | Sep 22 | Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long (1) APPE (append) or (2)… Affected: 3.4 |
| CVE-2002-0826 | – | Aug 12 | Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command Affected: 3.1.1 |
| CVE-2001-1021 | – | Jul 26 | Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDTM, (3) MLST, (4) MKD, (5) RMD, (6) RNFR, (7) RNTO, (8)… Affected: 2.0.2 |
| CVE-1999-1171 | – | Feb 2 | IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920 Affected: 1.0.1.e; 1.0.2.e |
| CVE-1999-1170 | – | Jan 2 | IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920 Affected: 1.0.1.e; 1.0.2.e |
Showing 28