File Transfer Software Vulnerabilities


The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.


Identifying all affected vendors is a good starting point for an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.


Sambar Server22
SolarWinds Serv-U21

Grouping vulnerabilities by products helps to get an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.


Official Fix603
Temporary Fix0
Not Defined324

Vendors and researchers are eager to find countermeasures to mitigate security vulnerabilities. These can be distinguished between multiple forms and levels of remediation which influence risks differently.


Not Defined564

Researcher and attacker which are looking for security vulnerabilities try to exploit them for academic purposes or personal gain. The level and quality of exploitability can be distinguished to determine simplicity and strength of attacks.

Access Vector

Not Defined0

The approach a vulnerability it becomes important to use the expected access vector. This is typically via the network, local, or physically even.


Not Defined0

To exploit a vulnerability a certail level of authentication might be required. Vulnerabilities without such a requirement are much more popular.

User Interaction

Not Defined0

Some attack scenarios require some user interaction by a victim. This is typical for phishing, social engineering and cross site scripting attacks.

C3BM Index

Our unique C3BM Index (CVSSv3 Base Meta Index) cumulates the CVSSv3 Meta Base Scores of all entries over time. Comparing this index to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

CVSSv3 Base


The Common Vulnerability Scoring System (CVSS) is an industry standard to define the characteristics and impacts of security vulnerabilities. The base score represents the intrinsic aspects that are constant over time and across user environments. Our unique meta score merges all available scores from different sources to aggregate to the most reliable result.

CVSSv3 Temp


The Common Vulnerability Scoring System (CVSS) uses temp scores to reflect the characteristics of a vulnerability that may change over time but not across user environments. This includes reporting confidence, exploitability and remediation levels. We do also provide our unique meta score for temp scores, even though other sources rarely publish them.



The moderation team is always defining the base vector and base score for an entry. These and all other available scores are used to generate the meta score.



The National Vulnerability Database (NVD) is also defining CVSS vectors and scores. These are usually not complete and might differ from VulDB scores.



A CVE Numbering Authority (CNA) is responsible for assigning new CVE entries. They might also include a CVSS score. These are usually not complete and might differ from VulDB scores.



Some vendors are willing to publish their own CVSS vectors and scores for vulnerabilities in their products. The coverage varies from vendor to vendor.



There are sometimes also security researcher which provide their own CVSS vectors and scores for vulnerabilities they have found and published.

Exploit 0-day


The moderation team is working with the threat intelligence team to determine prices for exploits. Our unique algorithm is used to identify the 0-day prices for an exploit, before it got distributed or became public. Calculated prices are aligned to prices disclosed by vulnerability broker and compared to prices we see on exploit markets.

Exploit Today


The 0-day prices do not consider time-relevant factors. The today price does reflect price impacts like disclosure of vulnerability details, alternative exploits, availability of countermeasures. These dynamic aspects might decrease the exploit prices over time. Under certain circumstances this happens very fast.

Exploit Market Volume

Our unique calculation of exploit prices makes it possible to forecast the expected exploit market volume. The calculated prices for all possible 0-day expoits are cumulated for this task. Comparing the volume to the amount of disclosed vulnerabilities helps to pinpoint the most important events.

🔴 CTI Activities

Our unique Cyber Threat Intelligence aims to determine the ongoing research of actors to anticipiate their acitivities. Observing exploit markets on the Darknet, discussions of vulnerabilities on mailinglists, and exchanges on social media makes it possible to identify planned attacks. Monitored actors and activities are classified whether they are offensive or defensive. They are also weighted as some actors are well-known for certain products and technologies. And some of their disclosures might contain more or less details about technical aspects and personal context. The world map highlights active actors in real-time.

Affected Products (303): 4D WebStar FTP Server, 5e5 Teamtek Universal FTP Server, 121 WAM! FTP Server, A-enterprise GoSamba, A-FTP Anonymous FTP Server, Accellion File Transfer Appliance, Accellion FTP Server, Accellion Secure File Transfer Appliance, acFTP FTP Server, AFTPD, Alex Linde FTP Server, ALTools ALFTP FTP Server, Andrew Tridgell rsync, Apache Cordova File Transfer Plugin, ArgoSoft FTP Server, ArGoSoft FTP Server, Ari Pikivirta Home FTP Server, Ari Pikivirta Home Ftp Server, atftpd, Axway File Transfer Direct, Ayukov NFTPD, Beasts vsftpd, Ben Spink CrushFTP Server, BeroFTPD, bftpd, Biba Software SeleniumServer FTP Server, Biscom Secure File Transfer, BisonFTP Server, Bisonware Bison FTP Server, Bisonware FTP Server, BisonWare FTP Server, Blackmoonftpserver BlackMoon FTP Server, Bolintech Dream FTP Server, BolinTech Dream FTP Server, BootManage TFTPD, bulletproof ftp server, CA Unicenter File Transfer Service, Cat Soft FTP Server, Cat Soft Serv-U, Cat Soft Serv-U FTP Server, Cerberus FTP Server, Cerberus FTP Server Enterprise Edition, Cerberusftp FTP Server, Charles Clark Meteor FTPD, Chesapeake TFTP Server, Cisco TFTP Server, Code Ocean FTP server, Conxint Conxint FTP Server, Cooolsoft Personal FTP Server, Core FTP Server, Core FTP Server, Crob Crob Ftp Server, Crob FTP Server, cwRsync, D-Link TFTP Server, Deerfield Serv-U, Digicraft Yak! FTP Server, Dong Joo Cho File Transfer iFamily, Downstairs.dnsalias Home FTP Server, Dxm2008 XM Easy Personal FTP Server, Dxmsoft XM Easy Personal FTP Server, Dynu FTP Server, Easy File Sharing FTP Server, EFS FTP Server, Elif Keir KnFTPd, EnterpriseDT CompleteFTP Server, Fightersoft Multimedia Star FTP server, File-transfer File Transfer, Filecopa-ftpserver FTP Server, FileZilla FileZilla Server, FileZilla Filezilla Server, FileZilla FileZilla Server Terminal, FileZilla Server, file transfer anywhere, fore FTP server, Frank Denis Pure-FTPd, FreeFloat FTP Server, freeFTPd, freeFTPd FTP, ftpd, FTPDMIN, FTP Server, FutureSoft TFTP Server 2000, FutureSoft TFTP Server Multithreaded, Gene6 FTP Server, Gene6 G6 FTP Server, glFTPd, Glftpd, glFTPD, GlFtpd, glFtpD, Globalscape Secure FTP Server, GlobalSCAPE Secure FTP Server, GNU Samba, Goodtech FTP Server, GoodTech FTP Server, GProFTPD, Grant Averett Ceberus FTP Server, Grant Averett Cerberus FTP Server, GSAMBAD, gtkftpd, GuildFTPd, GuildFTPD Server, H. Nomura Tiny FTPd, H. Nomura Tiny FTPdaemon, HD Soft Windows FTP Server, Honeywell FTP Server, hpaftpd, IBM alphaWorks TFTP Server, IBM MQ Managed File Transfer Agent, Inicom Networks ioFTPD, Ipswitch MOVEit File Transfer, Ipswitch Ws Ftp Home, IPswitch WS FTP Server, Ipswitch WS FTP Server, IPSwitch WS FTP Server, Ipswitch WS_FTP Server, Jarle Aase WarFTPd, Jesse Smith bftpd, Jgaa warftpd, Jgaa WarFTPd, Jgaa WarFTPD, Jose Carlos Medeiros maildirsync, KarjaSoft Sami FTP Server, Karjasoft Sami FTP Server, Kiwi TFTP server, Kmint21 Golden FTP Server, Kmint21 Software Golden FTP Server, Kmint21 Software Golden FTP server, Kunani FTP Server, Kunani ODBC FTP Server, Labtam-inc ProFTP, librsync, linux-ftpd, linux-ftpd-ssl, Linux FTP, Luke Mewburn tnftpd, Matrix FTP Server, Matthew Mondor mmftpd, Matthew Mondor mmpop3d, Matu FTP Server, Max-Wilhelm Bruker bftpd, Maxum Development Rumpus FTP Server, Medha WiFi FTP Server App, MELAG FTP Server, MeteorSoft FTP Server, Michael Roth Software Personal FTP Server, Microsoft File Transfer Manager, Miniftpd, Mollensoft Hyperion FTP Server, Mollensoft Lightweight FTP Server, MRSoft Personal FTP Server, Ncftpd FTP Server, NetMechanica NetDecision TFTP Server, Netscape Professional Services FTP Server, Netwin FTP Server, Nexgen FTP Server, NGC Active FTP Server, Novell Mini FTP Server, oftpd, Olive Tree FTP Server App, Olive Tree Ftp Server App, Open-FTPD, OpenAFS, OpenAFS Client, OpenFTPD FTP Server, Open TFTP Server MT, Open TFTP Server Multithreaded, Open TFTP Server SP, Oracle Managed File Transfer, Orenosv HTTP FTP Server, Orenosv Orenosv Http Ftp Server, OverByte ICS FTP Server, Pablo Baby FTP Server, Pablo FTP Server, Pablo Software Solutions Baby FTP Server, Pablo Software Solutions Quick N Easy FTP Server, PCMan FTP Server, PCMan's FTP Server, PFTP Server, PHPsFTPd, Pi-Soft SpoonFTP Server, PlatinumFTP FTP Server, Profelis SambaBox, ProFTPD, Progress WS_FTP Server, ProSysInfo TFTP Server TFTPDWIN, Provider4u Vsftpd Webmin module, PSFTPd, Pure-FTPd, PureFTPd, Pureftpd pure-FTPd, Pureftpd Pure-FTPd, QVT FTP Server, Radovan Garabik Pyftpd, RaidenFTPD, Raiden Professional Servers RaidenFTPD, Rhinosoft Serv-U, Rhinosoft Serv-U FTP Server, Ricoh DL FTP Server, RobotFTP Server, rsync, Rumpus FTP Server, Samba, samba-client Package, Samba-TNG, Samba Distcc, Samba pam_ntdom, Samba pam_smb, Samba rsync, Samba Server, Samba server, Samba smbd, Sambar, Sambar Sambar Server, Sambar Server, Sambar Server Pro, Sambar Server, SEGGER embOS FTP Server, Selom Ofori BlackMoon FTP Server, Serv-U, Serv-U FTP Server, Serv-U FTP Server, Serve TFTP Server, SFT Swift File Transfer Mobile, Simple Asynchronous File Transfer, Smallftpd, SmallFTPD FTP Server, SmallFTP Server, SmbFTPD, SolarWinds Serv-U, SolarWinds Serv-U Console, SolarWinds Serv-U File Server, SolarWinds Serv-U FTP Server, SolarWinds Serv-U Managed File Transfer, SolarWinds Serv-U MFT, SolarWinds TFTP Server, Sorin Chitu Telnet-FTP Server, South River FTP Server, South River Technologies Titan FTP Server, Ssamba, Steve Poulsen GuildFTPd, Steve Poulsen Guild FTPD, Stoney ftpd, Sun FTP Server, TallSoft Quick TFTP Server Pro, Team Johnlong RaidenFTPD, Term FTP Server, Texas Imperial WFTPD Pro Server, Texas Imperial Software WFTPD, Texas Imperial Software wftpd, Texas Imperial Software WFTPD Pro Explorer, Texas Imperial Software WFTPD Pro Server, Tftp-server Winagents Tftp Server, tftp32 TFTP Server, TFTP Server, TFTP Server MT, TFTP Server Single Port, TFTP Server SP, Thomas Krebs NiteServer FTPd, TIBCO Managed File Transfer, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, TIBCO Managed File Transfer Platform Server, Tinyftpd, Titan FTP Server, Transsoft Broker FTP Server, TransSoft Broker FTP Server, Trolltech Trollftpd, TYPSoft FTP Server, Typsoft FTP Server, Typsoft Typsoft FTP Server, Typsoft Typsoft Ftp Server, uftpd, uftpd FTP Server, University of Washington wu-ftpd, Vermillion ftpd, vsftpd, WarFTPD, wftpd, WFTPD, Wftpserver WinFTP FTP Server, Whitsoft SlimFTPd, Whitsoft Development SlimFTPd, WinAgents TFTP Server, WinFTP Server, WinFTP Wing FTP Server, WinFtp Server, winftp Server, Wing FTP Server, WS_FTP Server, wu-ftpd, Wu-FTPD, wzdftpd, WzdFTPD, Xlight FTP Server, Xlightftpd Xlight FTP Server, XLight FTP Server, XM Easy Personal FTP Server, Xynph FTP Server, yast2-samba-provision, YepYep mtftpd, YoungZSoft CC File Transfer

08/03/20224.34.1Progress WS_FTP Server Administrative Interface cross-site request forgeryWS_FTP ServerNot DefinedOfficial Fix0.02CVE-2022-36968
08/03/20223.53.4Progress WS_FTP Server Administrative Web Interface cross site scriptingWS_FTP ServerNot DefinedOfficial Fix0.02CVE-2022-36967
08/02/20225.04.8rsync File Name channel accessiblersyncNot DefinedOfficial Fix0.04CVE-2022-29154
07/29/20226.36.0Samba AD DC Database Audit Logging use after freeSambaNot DefinedOfficial Fix0.02CVE-2022-32746
07/29/20226.36.0Samba LDAP memory corruptionSambaNot DefinedOfficial Fix0.00CVE-2022-32745
07/29/20226.36.0Samba Password Change key managementSambaNot DefinedOfficial Fix0.00CVE-2022-32744
07/29/20226.36.0Samba SMB1 memory corruptionSambaNot DefinedOfficial Fix0.04CVE-2022-32742
07/29/20225.55.3Samba KDC/Password Service missing critical step in authenticationSambaNot DefinedOfficial Fix0.02CVE-2022-2031
07/19/20227.57.3Oracle Managed File Transfer MFT Runtime Server denial of serviceManaged File TransferNot DefinedOfficial Fix2.29CVE-2021-42340
07/07/20225.95.7glFTPd Connection Limit denial of serviceglFTPdProof-of-ConceptNot Defined0.09CVE-2021-31645
06/24/20224.44.4MELAG FTP Server Configuration File cleartext storage in a file or on diskFTP ServerNot DefinedNot Defined0.03CVE-2021-41639
06/24/20226.26.2MELAG FTP Server FTP Configuration File access controlFTP ServerNot DefinedNot Defined0.09CVE-2021-41637
06/24/20224.44.4MELAG FTP Server information disclosureFTP ServerNot DefinedNot Defined0.03CVE-2021-41634
06/24/20227.47.4MELAG FTP Server improper authenticationFTP ServerNot DefinedNot Defined0.03CVE-2021-41638
06/24/20226.96.9MELAG FTP Server CWD Command access controlFTP ServerNot DefinedNot Defined0.06CVE-2021-41636
06/24/20228.48.4MELAG FTP Server unnecessary privilegesFTP ServerNot DefinedNot Defined0.00CVE-2021-41635
05/18/20224.34.2SolarWinds Serv-U Configuration access controlServ-UNot DefinedOfficial Fix0.06CVE-2021-35249
05/10/20227.97.9TIBCO Managed File Transfer Command Center DOM XML Parser/SAX XML Parser xml external entity referenceManaged File Transfer Command Center/Managed File Transfer Internet ServerNot DefinedNot Defined0.03CVE-2022-22774
04/26/20226.46.3SolarWinds Serv-U file information disclosureServ-UNot DefinedOfficial Fix0.04CVE-2021-35250
04/19/20225.35.2Oracle Managed File Transfer MFT Runtime Server request smugglingManaged File TransferNot DefinedOfficial Fix0.05CVE-2021-33037
04/19/20226.66.4Oracle Managed File Transfer MFT Runtime Server input validationManaged File TransferNot DefinedOfficial Fix0.00CVE-2021-44832
04/01/20226.36.1freeFTPd unquoted search pathfreeFTPdNot DefinedNot Defined0.04CVE-2022-27052
03/30/20228.08.0TIBCO Managed File Transfer Platform Server cfsend/cfrecv/CyberResp Privilege EscalationManaged File Transfer Platform ServerNot DefinedNot Defined0.03CVE-2022-22772
03/30/20223.13.1Profelis SambaBox Group cross site scriptingSambaBoxNot DefinedNot Defined0.00CVE-2022-25620
03/30/20224.04.0Profelis SambaBox Ping Tool command injectionSambaBoxNot DefinedNot Defined0.03CVE-2022-25619

971 more entries are not shown

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!