CVE-2020-9274

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.

• CWE-824

• https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefaPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/02/msg00029.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/
• https://security.gentoo.org/glsa/202003-54Third Party Advisory
• https://usn.ubuntu.com/4515-1/Third Party Advisory
• https://www.pureftpd.org/project/pure-ftpd/news/Vendor Advisory
• https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefaPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/02/msg00029.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/
• https://security.gentoo.org/glsa/202003-54Third Party Advisory
• https://usn.ubuntu.com/4515-1/Third Party Advisory
• https://www.pureftpd.org/project/pure-ftpd/news/Vendor Advisory

Published

Feb 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9268SoPlanning 1.45 is vulnerable to SQL Injection in the OrderB…7.5
• CVE-2020-9269SOPlanning 1.45 is vulnerable to authenticated SQL Injection…7.2
• CVE-2020-9270ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password …8.8
• CVE-2020-9271ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user crea…6.5
• CVE-2020-9272ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability …7.5
• CVE-2020-9273In ProFTPD 1.3.7, it is possible to corrupt the memory pool …8.8
• CVE-2020-9275An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9276An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…8.8
• CVE-2020-9277An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9278An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.1
• CVE-2020-9279An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9280In SilverStripe through 4.5, files uploaded via Forms to fol…7.5