48 matches found
Design/Logic Flaw
cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...
CVE-2017-17933
NetWin SurgeFTP 23f2 contains a stored cross-site scripting (XSS) flaw in the Web Manager CGI at cgi/surgeftpmgr.cgi (ports 7021/9021). The vulnerability arises from insufficient input filtering for the classid, domainid, and username parameters, enabling an attacker to inject malicious scripts. ...
CVE-2017-17933
cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...
NetWin SurgeFTP 23f2 Cross Site Scripting
Exploit Title: Multiple stored Cross-site scripting in NetWin SurgeFTP version 23f2 CVE: CVE-2017-17933 Date: 27-12-2017 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://netwinsite.com Category: webapps Attack Type: Remote Impact: Code execution 1...
Netwin SurgeFTP Sever 23d6 存储型跨站脚本攻击漏洞.
No description provided by source...
Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting
Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities Date: 11/18/2015 Exploit Author: UnN0n Vendor: NetWin Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp Version: 23d6 Tested on: Windows 7 x6464bit Info Surgeftp web-interface suffers wit...
Netwin SurgeFTP Remote Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
Netwin SurgeFTP 2.3a1 SurgeFTPMGR.CGI Multiple Input Validation Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/21534/info Netwin SurgeFTP is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. A successful exploit of these vulnerabilities could allow an attacker to compromise the...
CVE-2013-4742
Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string within the authentication request...
CVE-2013-4742
CVE-2013-4742 describes a buffer overflow in SurgeFTP Server (NetWin SurgeFTP) prior to version 23d2 triggered during authentication by a long string in the request. The effect is a denial of service (crash) and potentially arbitrary code execution via memory corruption on heap/stack. Root cause:...
CVE-2013-4742
Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string within the authentication request...
Netwin SurgeFTP Remote Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Netwin SurgeFTP...
Netwin SurgeFTP - Remote Command Execution (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Netwin SurgeFTP...
Netwin SurgeFTP Remote Command Execution
This module exploits a vulnerability found in Netwin SurgeFTP, version 23c8 or prior. In order to execute commands via the FTP service, please note that you must have a valid credential to the web-based administrative console. Module Options msf use exploit/multi/http/netwin/surgeftpexec msf...
CVE-2008-1052
The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...
CVE-2008-1052
The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...
Netwin SurgeFTP 2.3a1 - SurgeFTPMGR.cgi Multiple Input Validation Vulnerabilities
Netwin SurgeFTP 2.3a1 - SurgeFTPMGR.cgi Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/21534/info Netwin SurgeFTP is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. A successful exploit of these...
Netwin SurgeFTP 2.3a1 - 'SurgeFTPMGR.cgi' Multiple Input Validation Vulnerabilities
source: https://www.securityfocus.com/bid/21534/info Netwin SurgeFTP is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data,...
CVE-2001-1356
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...