Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-3331
9.8
CRITICALCVSS v3
Published
January 27, 2021
CVSS v2
10 HIGH
Affected
3 projects
Assigned by
MITRE
Severity scale
010
Description
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
winscp/winscp
GitHubWinSCP is a popular free file manager for Windows supporting SFTP, FTP, FTPS, SCP, S3, WebDAV and local-to-local file transfers. A powerful tool to enhance your productivity with a user-friendly interface and automation options like .NET assembly.
GitHubWinSCP is a popular free file manager for Windows supporting SFTP, FTP, FTPS, SCP, S3, WebDAV and local-to-local file transfers. A powerful tool to enhance your productivity with a user-friendly interface and automation options like .NET assembly.< 5.17.10NVD
WinSCP
ChocolateyWinSCP is an open source free SFTP client, SCP client, FTPS client and FTP client for Windows. Its main function is file transfer between a local and a remote computer. Beyond this, WinSCP offers scripting and basic file manager functionality.
## Features
- Graphical user interface
- Translated into many languages
- Integration with Windows (drag and drop, URL, shortcut icons, jump list)
- All common operations with files
- Support for SFTP and SCP protocols over SSH and FTP and WebDAV protocols
- Batch file scripting and command-line interface and .NET assembly for advanced programming tasks
- Directory synchronization in several semi or fully automatic ways
- Integrated text editor
- Shares site settings with PuTTY
- Support for password, keyboard-interactive, public key and Kerberos (GSS) authentication
- Integrates with Pageant (PuTTY authentication agent) for full support of public key authentication with SSH
- Explorer and Commander interfaces
- Optionally protects stored site information with master password
- Optionally supports portable operation using a configuration file in place of registry entries, suitable for operation from removable media
## Notes
- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
ChocolateyWinSCP is an open source free SFTP client, SCP client, FTPS client and FTP client for Windows. Its main function is file transfer between a local and a remote computer. Beyond this, WinSCP offers scripting and basic file manager functionality.
## Features
- Graphical user interface
- Translated into many languages
- Integration with Windows (drag and drop, URL, shortcut icons, jump list)
- All common operations with files
- Support for SFTP and SCP protocols over SSH and FTP and WebDAV protocols
- Batch file scripting and command-line interface and .NET assembly for advanced programming tasks
- Directory synchronization in several semi or fully automatic ways
- Integrated text editor
- Shares site settings with PuTTY
- Support for password, keyboard-interactive, public key and Kerberos (GSS) authentication
- Integrates with Pageant (PuTTY authentication agent) for full support of public key authentication with SSH
- Explorer and Commander interfaces
- Optionally protects stored site information with master password
- Optionally supports portable operation using a configuration file in place of registry entries, suitable for operation from removable media
## Notes
- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
NuGet Gallery