CrushFTP 11.0.0 to 11.3.0 are vulnerable. Update to 11.3.1+ immediately.# CrushFTP 10.0.0 to 10.8.3 are vulnerable. Update to 10.8.4+ immediately.#

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Friday, 04-Apr-2025 21:21:28 JST Will Dormann

   in reply to

   There's this magical thinking that the CVE ID is what gives attackers the ability to compromise systems.

   If you say that your software is vulnerable but fail to assign CVEs, you're only helping the attackers.

   I remember the time that Microsoft got mad at me for "leaking" one of their CVEs to the public before the update was available. As in their world, CVE IDs were for Microsoft updates. Not for identifying vulnerabilities. 🤦♂️