CVE

Id
27126  
CVE No.
CVE-2007-3769  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.  
Phase
Assigned (20070715)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
277623 27126 CVE-2007-3769 FULLDISC:20070710 Portcullis Computer Security Ltd - Advisories  View
277624 27126 CVE-2007-3769 URL:http://marc.info/?l=full-disclosure&m=118409539009277&w=2  View
277625 27126 CVE-2007-3769 MISC:http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0031.txt  View
277626 27126 CVE-2007-3769 VUPEN:ADV-2007-2528  View
277627 27126 CVE-2007-3769 URL:http://www.vupen.com/english/advisories/2007/2528  View
277628 27126 CVE-2007-3769 OSVDB:37911  View
277629 27126 CVE-2007-3769 URL:http://osvdb.org/37911  View
277630 27126 CVE-2007-3769 SECUNIA:26061  View
277631 27126 CVE-2007-3769 URL:http://secunia.com/advisories/26061  View
277632 27126 CVE-2007-3769 XF:surgeftp-error-xss(35378)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
57165 JVNDB-2007-005857 Symantec AntiVirus Corporate Edition および Client Security におけるスタックベースのバッファオーバーフローの脆弱性 Symantec AntiVirus Corporate Edition および Client Security の Internet E-mail Auto-Protect 機能には、スタックベースのバッファオーバーフローの脆弱性が存在します。 CVE-2007-3771 27126 4.6 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005857.html  View