CVE-2008-1052: Improper Restriction of Operations within the Bounds of a Memory Buffer

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

Netwin SurgeFTP 2.3a1 - SurgeFTPMGR.cgi Multiple Input Validation Vulnerabilities

Netwin SurgeFTP 2.3a1 - SurgeFTPMGR.cgi Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/21534/info Netwin SurgeFTP is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. A successful exploit of these...

Netwin SurgeFTP 2.3a1 - 'SurgeFTPMGR.cgi' Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/21534/info Netwin SurgeFTP is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data,...

CVE-2001-1356

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...

CVE-2001-1356: Undefined Security Weakness

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...

CVE-2001-0697

NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...

CVE-2001-0698

NetWin SurgeFTP (SurgeFTP) versions 2.0a and 1.0b are affected by a directory traversal vulnerability in the nlist command, enabling remote attackers to list files and directories outside the FTP root due to insufficient input validation. CERT reports Surge FTP Server 2.0a allows remote users to ...

CVE-2001-0697

Technical details are not publicly provided in the supplied documents for CVE-2001-0697. Monitor for updates.

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b are affected by CVE-2001-0696: a remote attacker can cause a denial of service (crash) by issuing a CD command to a directory named with an MS-DOS device name (e.g., con). The available sources confirm the vulnerability exists and describe the impact as a crash/DoS, ...

CVE-2001-0697: Undefined Security Weakness

NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...

CVE-2001-0696: Undefined Security Weakness

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0698: Undefined Security Weakness

Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0697

NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...

CVE-2001-0698

Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command...

CVE-2001-1356

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...