Skip to content

Vendor

efs software vulnerabilities

22 published CVES affecting efs software, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
22
Critical
3
High
3
Medium
16
Low
0
Unscored
0
CISA KEV
0
Atom feed of efs software alerts

Products

Latest efs software CVEs

Newest publication first

  2. CVE-2023-4497 Easy Chat Server XSS vulnerability

    Published
    MediumCVSS 6.1 EPSS 0.42%

    Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.

  3. CVE-2023-4496 Easy Chat Server XSS vulnerability

    Published
    MediumCVSS 6.1 EPSS 0.42%

    Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter.

  4. CVE-2023-4495 Easy Chat Server XSS vulnerability

    Published
    MediumCVSS 6.1 EPSS 0.42%

    Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp.

  5. CVE-2023-4494 Easy Chat Server Stack-based buffer overflow vulnerability

    Published
    CriticalCVSS 9.8 EPSS 0.98%

    Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.

  6. CVE-2023-4493 Easy Address Book Web Server Stored XSS vulnerability

    Published
    MediumCVSS 5.4 EPSS 0.50%

    Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulne...

  7. CVE-2023-4492 Easy Address Book Web Server XSS vulnerability

    Published
    MediumCVSS 6.1 EPSS 0.42%

    Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip) of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload sp...

  8. CVE-2023-4491 Easy Address Book Web Server Buffer overflow vulnerability

    Published
    CriticalCVSS 9.8 EPSS 0.98%

    Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the r...

  9. CVE-2006-6933 Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files via direct requests to files such as (1)....

    Published
    HighCVSS 7.8 EPSS 2.2%

    Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files via direct requests to files such as (1) ServerKey.pem and (2) AcceptIP.txt. NOTE: The provenance of this information is...

  10. CVE-2006-5715 Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of an HTTP GET requ...

    Published
    MediumCVSS 5.0 EPSS 6.4% Public exploit

    Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of an HTTP GET request, which accesses the alternate data stream.

  11. CVE-2006-5714 Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of a HTTP GET request,...

    Published
    MediumCVSS 5.0 EPSS 6.4% Public exploit

    Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of a HTTP GET request, which accesses the alternate data stream.

  12. CVE-2006-5713 Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) author, (2) content, or (3) title paramete...

    Published
    MediumCVSS 4.3 EPSS 1.2%

    Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) author, (2) content, or (3) title parameters when posting a forum thread. NOTE: the provenance of this information is unkn...

  14. CVE-2006-3952 Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command. NOTE: the provenance of this inf...

    Published
    HighCVSS 7.5 EPSS 66.8% Framework module Public exploit

    Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  17. CVE-2006-1159 Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifie...

    Published
    HighCVSS 7.8 EPSS 6.8% PoC

    Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.

  20. CVE-2004-2466 chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a buffer overflow. NOTE: it was later reported that....

    Published
    MediumCVSS 5.0 EPSS 74.7% Framework module Public exploit PoC

    chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a buffer overflow. NOTE: it was later reported that 2.2 is also affected.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.