CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25179
https://notcve.org/view.php?id=CVE-2021-25179
SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header. SolarWinds Serv-U versiones anteriores a 15.2, está afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) por medio del encabezado HTTP Host • https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2_release_notes.htm https://github.com/matrix https://twitter.com/gm4tr1x https://www.linkedin.com/in/gabrielegristina • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 89EXPL: 3CVE-2011-4800 – Serv-U FTP Server - Jail Break
https://notcve.org/view.php?id=CVE-2011-4800
Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands. Vulnerabilidad de salto de directorio en Serv-U FTP Server antes de v11.1.0.5 permite a usuarios autenticados remotamente leer y escribir archivos de su elección y listar y crear directorios de su elección a través de "..:/" (punto punto dos puntos barra oblicua) en los comandos (1) list, (2) put, o (3) get. • https://www.exploit-db.com/exploits/18182 http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0454.html http://secunia.com/advisories/47021 http://www.exploit-db.com/exploits/18182 http://www.serv-u.com/releasenotes • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.0EPSS: 0%CPEs: 62EXPL: 0CVE-2009-4815
https://notcve.org/view.php?id=CVE-2009-4815
Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en Serv-U en versiones anteriores a la 9.2.0.1 permite a atacantes remotos autenticados leer ficheros de su elección mediante vectores no especificados. • http://secunia.com/advisories/37847 http://www.securityfocus.com/bid/37414 http://www.serv-u.com/releasenotes http://www.vupen.com/english/advisories/2009/3595 https://exchange.xforce.ibmcloud.com/vulnerabilities/54932 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2005-3467
https://notcve.org/view.php?id=CVE-2005-3467
Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service (crash) via (1) malformed packets and possibly other unspecified issues with unknown impact and attack vectors including (2) use of "~" in a pathname, and (3) memory consumption of the daemon. NOTE: it is not clear whether items (2) and above are vulnerabilities. • http://secunia.com/advisories/17409 http://securitytracker.com/id?1015151 http://www.securityfocus.com/bid/15273 http://www.serv-u.com/releasenotes.asp http://www.vupen.com/english/advisories/2005/2267 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 12EXPL: 3CVE-2004-2532 – RhinoSoft Serv-U FTP Server 3.x < 5.x - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2004-2532
Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary commands by connecting to the server using the default administrator account, creating a new user, logging in as that new user, and then using the SITE EXEC command. • https://www.exploit-db.com/exploits/381 http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0216.html http://www.osvdb.org/8877 http://www.securityfocus.com/bid/10886 https://exchange.xforce.ibmcloud.com/vulnerabilities/16925 • CWE-255: Credentials Management Errors •