CVE-2021-37533

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.

• CWE-20

• http://www.openwall.com/lists/oss-security/2022/12/03/1Issue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7Issue Tracking, Mailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00038.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5307Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/03/1Issue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7Issue Tracking, Mailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00038.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5307Third Party Advisory

Published

Dec 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37524Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26…6.1
• CVE-2021-37529A double-free vulnerability exists in fig2dev through 3.28a …5.5
• CVE-2021-3753A race problem was seen in the vt_k_ioctl in drivers/tty/vt/…4.7
• CVE-2021-37530A denial of service vulnerabiity exists in fig2dev through 3…5.5
• CVE-2021-37531SAP NetWeaver Knowledge Management XML Forms versions - 7.10…8.8
• CVE-2021-37532SAP Business One version - 10, due to improper input validat…4.3
• CVE-2021-37534app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Store…5.4
• CVE-2021-37535SAP NetWeaver Application Server Java (JMS Connector Service…9.8
• CVE-2021-37538Multiple SQL injection vulnerabilities in SmartDataSoft Smar…9.8
• CVE-2021-37539Zoho ManageEngine ADManager Plus before 7111 is vulnerable t…9.8
• CVE-2021-3754A flaw was found in keycloak where an attacker is able to re…5.3
• CVE-2021-37540In JetBrains Hub before 2021.1.13262, a potentially insuffic…6.5