CVE-2001-1356

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...

CVE-2001-1356

Affected software: NetWin SurgeFTP 2.0f and earlier. Vulnerability: passwords are encrypted with weak hashing, a fixed salt, and modulo 40 arithmetic, enabling remote attackers to perform brute‑force password guessing against the administrator account on port 7021. Impact: attacker could compromi...

CVE-2001-1355

Buffer overflows in NetWin Authentication Module NWAuth 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to 1 the -del command or 2 the -lookup command...

CVE-2001-1354

NetWin Authentication module NWAuth 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password...

CVE-2001-1355

Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail and SurgeFTP (and possibly other packages), could allow attackers to execute arbitrary code via long arguments to the -del or -lookup commands. The vulnerability is a result of unsafe handling of l...

CVE-2001-1356: Undefined Security Weakness

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...

CVE-2001-1355: Undefined Security Weakness

Buffer overflows in NetWin Authentication Module NWAuth 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to 1 the -del command or 2 the -lookup command...

CVE-2001-1354: Undefined Security Weakness

NetWin Authentication module NWAuth 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password...

CVE-2002-0310

Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...

CVE-2002-0290

Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument...

CVE-2002-0273

CVE-2002-0273 affects NetWin CWMail.exe prior to version 2.8a. The vulnerability is a buffer overflow in CWMail.exe that allows remote authenticated users to execute arbitrary code by submitting a long item parameter. This is the core impact stated across multiple sources in the connected documen...

CVE-2002-0310

CVE-2002-0310 affects Netwin WebNews 1.1k CGI. The issue arises from default usernames and cleartext passwords that cannot be deleted by the administrator, enabling remote attackers to gain privileges using the listed credential pairs (testweb/newstest, alwn3845/imaptest, alwi3845/wtest3452, test...

CVE-2002-0310

Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...

CVE-2002-0273: Undefined Security Weakness

Buffer overflow in CWMail.exe in NetWin before 2.8a allows remote authenticated users to execute arbitrary code via a long item parameter...

CVE-2002-0310: Undefined Security Weakness

Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...

CVE-2001-0697

NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...

CVE-2001-0697

Technical details are not publicly provided in the supplied documents for CVE-2001-0697. Monitor for updates.

CVE-2001-0698

NetWin SurgeFTP (SurgeFTP) versions 2.0a and 1.0b are affected by a directory traversal vulnerability in the nlist command, enabling remote attackers to list files and directories outside the FTP root due to insufficient input validation. CERT reports Surge FTP Server 2.0a allows remote users to ...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b are affected by CVE-2001-0696: a remote attacker can cause a denial of service (crash) by issuing a CD command to a directory named with an MS-DOS device name (e.g., con). The available sources confirm the vulnerability exists and describe the impact as a crash/DoS, ...