Monthly
Authenticated users of Cerberus FTP Server (all releases prior to 2026.3.0) can supply a UNC/SMB path such as \\attacker-host\share into a parameter that accepts path values, causing the service to initiate an outbound SMB authentication and thereby leak the Cerberus service account's Net-NTLMv2 hash to an attacker-controlled listener. Impact is credential exposure rather than code execution: confidentiality is rated high while integrity and availability are unaffected, and the assessed vector requires an existing authenticated session (PR:L) with no user interaction. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation additionally depends on the server being permitted to reach the attacker over outbound TCP 139/445, so the practical risk is moderate and environment-dependent.
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Adb Explorer contains a vulnerability that allows attackers to set the binary's path to point to a remote network resource, hosted on an attack (CVSS 7.8).
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. Rated medium severity (CVSS 4.7), this vulnerability is no authentication required. No vendor patch available.
Authenticated users of Cerberus FTP Server (all releases prior to 2026.3.0) can supply a UNC/SMB path such as \\attacker-host\share into a parameter that accepts path values, causing the service to initiate an outbound SMB authentication and thereby leak the Cerberus service account's Net-NTLMv2 hash to an attacker-controlled listener. Impact is credential exposure rather than code execution: confidentiality is rated high while integrity and availability are unaffected, and the assessed vector requires an existing authenticated session (PR:L) with no user interaction. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation additionally depends on the server being permitted to reach the attacker over outbound TCP 139/445, so the practical risk is moderate and environment-dependent.
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Adb Explorer contains a vulnerability that allows attackers to set the binary's path to point to a remote network resource, hosted on an attack (CVSS 7.8).
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. Rated medium severity (CVSS 4.7), this vulnerability is no authentication required. No vendor patch available.