Biscom
Biscom Secure File Transfer: vulnerabilidades y CVE
Biscom Secure File Transfer tiene 7 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-27646 | Media (6.5) | 1.0% | — | 22 oct 2020 | Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft. |
| CVE-2020-8796 | Crítica (9.8) | 2.9% | — | 7 feb 2020 | Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. |
| CVE-2020-8503 | Media (6.5) | 0.73% | — | 31 ene 2020 | Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender because of an error in a file-upload feature. This is… |
| CVE-2016-10710 | Alta (8.1) | 1.1% | — | 25 ene 2018 | Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests.… |
| CVE-2017-5247 | Media (5.4) | 0.50% | — | 18 jul 2017 | Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard… |
| CVE-2017-5246 | Media (4.3) | 0.60% | — | 18 jul 2017 | Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{… |
| CVE-2017-5241 | Media (5.4) | 0.88% | — | 28 jun 2017 | Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the… |