Maxum Rumpus any version

Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTTP verb in the HTTP component; and allow remote authenticated users to execute arbitrary code via a long argument to the (2) MKD, (3) XMKD, (4) RMD, and other unspecified commands in the FTP component.

Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation

Rumpus - FTP server Cross-site request forgery (CSRF) – Create user

Rumpus - FTP server Improper Token Verification

Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vector

Rumpus - FTP server Reflected cross-site scripting (RXSS)

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server.