https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 07:40:21 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-03027 cnvd-2020-03027 https://cve.radiocsirt.org/vuln/cnvd-2020-03027 https://cve.radiocsirt.org/vuln/euvd-2026-36415 EUVD-2026-36415 https://cve.radiocsirt.org/vuln/euvd-2026-36415 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5204 <p>In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&amp;#39;255.255.255.255&amp;#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11</p> <p>In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&amp;#39;255.255.255.255&amp;#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-5204 https://cve.radiocsirt.org/vuln/ghsa-4g9j-24m6-cjw4 <p>In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&amp;#39;255.255.255.255&amp;#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11</p> <p>In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&amp;#39;255.255.255.255&amp;#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11</p> https://cve.radiocsirt.org/vuln/ghsa-4g9j-24m6-cjw4 https://cve.radiocsirt.org/vuln/gsd-2020-5204 gsd-2020-5204 https://cve.radiocsirt.org/vuln/gsd-2020-5204 https://cve.radiocsirt.org/vuln/opensuse-su-2020:0069-1 <p>Security update for uftpd</p> <p>Security update for uftpd</p> https://cve.radiocsirt.org/vuln/opensuse-su-2020:0069-1