CVE-2017-6465

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, leading to a buffer overflow situation.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/141456/FTPShell-Client-6.53-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/96570Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41511/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/141456/FTPShell-Client-6.53-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/96570Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41511/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-64668.1F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not pe CVE-2017-64677.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This CVE-2017-64687.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was add CVE-2017-64697.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file CVE-2017-64707.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. CVE-2017-64717.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. Th CVE-2017-64727.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed cap CVE-2017-64737.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed CVE-2017-64747.5In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This CVE-2017-64786.1paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).CVE-2017-64796.1FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter).CVE-2017-64806.1groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter).