https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 10:05:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102722 <p>In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.</p> <p>In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102722 https://db.gcve.eu/vuln/ghsa-p9rr-8wmf-9r7v <p>In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server&#39;s `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.</p> <p>In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server&#39;s `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.</p> https://db.gcve.eu/vuln/ghsa-p9rr-8wmf-9r7v