Netwin Surgeftp
15 CVEs affecting Netwin Surgeftp. Latest disclosed: 2025-08-05. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17933 | Medium | 6.1 | 2017-12-29 | cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username par… |
CVE-2012-10028 | | 2025-08-05 | Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary sy… | |
CVE-2013-4742 | | 2013-08-09 | Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long strin… | |
CVE-2010-1068 | | 2010-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in surgeftpmgr.cgi in NetWin SurgeFTP 2.3a6 allow remote attackers to inject arbitrary web script or HTML v… | |
CVE-2008-1052 | | 2008-02-27 | The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer i… | |
CVE-2007-3769 | | 2007-07-15 | Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbit… | |
CVE-2007-3768 | | 2007-07-15 | The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV comma… | |
CVE-2005-1034 | | 2005-05-02 | SurgeFTP 2.2m1 allows remote attackers to cause a denial of service (application hang) via the LEAK command. | |
CVE-2004-2318 | | 2004-12-31 | The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of service (crash) vi… | |
CVE-2001-0698 | | 2001-09-20 | Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command. | |
CVE-2001-0697 | | 2001-09-20 | NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service (crash) via an 'ls ..' command. | |
CVE-2001-0696 | | 2001-09-20 | NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service (crash) via a CD command to a directory with an MS-DOS device name such as… | |
CVE-2001-1356 | | 2001-08-04 | NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct… | |
CVE-2001-1355 | | 2001-07-20 | Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attacke… | |
CVE-2001-1354 | | 2001-07-20 | NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could all… |