accellion ftp server vulnerabilities

Latest accellion ftp server CVEs

Newest publication first

1. CVE-2016-9500 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure

   Published 2018-07-13

   Medium·CVSS 6.1 EPSS 5.4%

   Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.

2. CVE-2016-9499 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.

   Published 2018-07-13

   Medium·CVSS 5.3 EPSS 7.7%

   Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.