Format string vulnerability in Ipswitch WSFTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.

Cross-site scripting (XSS) vulnerability in Ipswitch WSFTP allows remote attackers to inject arbitrary web script or HTML via arguments to a valid command, which is not properly handled when it is displayed by the view log option in the administration interface. NOTE: this can be leveraged to create a new admin account.

The Logging Server (Logsrv.exe) in IPSwitch WSFTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp.

Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WSFTP Home and Professional 2007 allows remote attackers to cause a denial of service (NULL dereference and application crash) via unspecified vectors related to "improper arguments."

Buffer overflow in Ipswitch WSFTP Home client allows remote FTP servers to have an unknown impact via a long "message response."

Format string vulnerability in Ipswitch WSFTP Home 2007.0.0.2 and WSFTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in a connection greeting (response).

The Logging Server (ftplogsrv.exe) 7.9.14.0 and earlier in IPSwitch WSFTP 6.1 allows remote attackers to cause a denial of service (loss of responsiveness) via a large number of large packets to port 5151/udp, which causes the listening socket to terminate and prevents log commands from being recorded, a different vulnerability than CVE-2007-3823.