cpe:2.3:a:netwin:surgeftp:1.0b:*:*:*:*:*:*:*
Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string within the authentication request.
Max CVSS
7.5
EPSS Score
11.01%
Published
2013-08-09
Updated
2017-08-29
Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.
Max CVSS
5.8
EPSS Score
0.18%
Published
2007-07-15
Updated
2017-07-29
The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command.
Max CVSS
8.5
EPSS Score
1.06%
Published
2007-07-15
Updated
2017-07-29
Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.
Max CVSS
10.0
EPSS Score
0.78%
Published
2001-07-20
Updated
2017-12-19
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Max CVSS
4.6
EPSS Score
0.04%
Published
2001-07-20
Updated
2017-12-19
Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command.
Max CVSS
5.0
EPSS Score
0.68%
Published
2001-09-20
Updated
2017-10-10
NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service (crash) via an 'ls ..' command.
Max CVSS
5.0
EPSS Score
1.73%
Published
2001-09-20
Updated
2017-10-10
NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service (crash) via a CD command to a directory with an MS-DOS device name such as con.
Max CVSS
5.0
EPSS Score
0.81%
Published
2001-09-20
Updated
2017-10-10
8 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!