CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, a directory containing user profile files (including password hashes) is world-readable/writable. An unprivileged Windows user with filesystem access can copy a valid profile to that directory to create an FTP user, potentially gaining read/replace acc...

CVE-2020-35481

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

CVE-2020-35481

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

Cross site scripting

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

Design/Logic Flaw

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

Cross site scripting

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

Directory traversal

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-28001

The CVE-2020-28001 issue affects SolarWinds Serv-U FTP Server (before 15.2.2). The vulnerability arises from improper sanitization/validation of user-supplied directory names in the web application, enabling an authenticated Stored XSS when a crafted directory name is processed (and potentially t...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-27994

CVE-2020-27994 affects SolarWinds Serv-U FTP Server prior to 15.2.2. It is an authenticated directory traversal vulnerability in which the server does not validate path information correctly, allowing a logged-in user to read files outside the user’s home directory via a crafted HTTP GET request....

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-35482

CVE-2020-35482 affects SolarWinds Serv-U FTP Server before v15.2.2, where an authenticated user can trigger a reflected Cross-Site Scripting (XSS) vulnerability in the web context. The vulnerability is linked to SolarWinds Serv-U 15.2.2 release notes as the fix/upgrade path. Connected sources cor...

CVE-2020-35481

Affected software: SolarWinds Serv-U before version 15.2.2. Issue: Unauthenticated Macro Injection leading to high-impact outcomes (confidentiality, integrity, and availability) per CVSS metrics (CVSS‑3.1: CRITICAL, 9.8). Root cause and exact exploit path are not detailed in the supplied document...