ProFTPD
An open-source FTP server software widely used on Unix/Linux systems, supporting features such as virtual hosts and anonymous access, and which has experienced multiple access-control security vulnerabilities.
Timeline (last 90 days)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
The access control flaw in ProFTPD allows a remote attacker to read and write arbitrary files via the two commands site cpfr and site cpto (CWE-284), and a fixing patch has existed since 2015.
The fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
All Facts (3)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
50%UnverifiedThe access control flaw in ProFTPD allows a remote attacker to read and write arbitrary files via the two commands site cpfr and site cpto (CWE-284), and a fixing patch has existed since 2015.
50%UnverifiedThe fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
50%