217 matches found
CVE-2001-1354
NetWin Authentication module NWAuth 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password...
CVE-2001-1356
Affected software: NetWin SurgeFTP 2.0f and earlier. Vulnerability: passwords are encrypted with weak hashing, a fixed salt, and modulo 40 arithmetic, enabling remote attackers to perform brute‑force password guessing against the administrator account on port 7021. Impact: attacker could compromi...
CVE-2001-1355
Buffer overflows in NetWin Authentication Module NWAuth 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to 1 the -del command or 2 the -lookup command...
CVE-2001-1354
The CVE-2001-1354 entry concerns the NetWin Authentication module (NWAuth) versions 2.0 and 3.0b, as implemented in SurgeFTP and DMail (and possibly other packages). The root cause is weak password hashing used by NWAuth, which could enable local users to decrypt stored passwords or to log in wit...
CVE-2002-0290
Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument...
CVE-2002-0310
Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...
CVE-2002-0310
CVE-2002-0310 affects Netwin WebNews 1.1k CGI. The issue arises from default usernames and cleartext passwords that cannot be deleted by the administrator, enabling remote attackers to gain privileges using the listed credential pairs (testweb/newstest, alwn3845/imaptest, alwi3845/wtest3452, test...
CVE-2002-0310
Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...
CVE-2002-0273
CVE-2002-0273 affects NetWin CWMail.exe prior to version 2.8a. The vulnerability is a buffer overflow in CWMail.exe that allows remote authenticated users to execute arbitrary code by submitting a long item parameter. This is the core impact stated across multiple sources in the connected documen...
CVE-2001-0697
NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...
CVE-2001-0698
NetWin SurgeFTP (SurgeFTP) versions 2.0a and 1.0b are affected by a directory traversal vulnerability in the nlist command, enabling remote attackers to list files and directories outside the FTP root due to insufficient input validation. CERT reports Surge FTP Server 2.0a allows remote users to ...
CVE-2001-0696
NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...
CVE-2001-0696
NetWin SurgeFTP 2.0a and 1.0b are affected by CVE-2001-0696: a remote attacker can cause a denial of service (crash) by issuing a CD command to a directory named with an MS-DOS device name (e.g., con). The available sources confirm the vulnerability exists and describe the impact as a crash/DoS, ...
CVE-2001-0697
Technical details are not publicly provided in the supplied documents for CVE-2001-0697. Monitor for updates.
Netwin Webnews Buffer Overflow Vulnerability (#NISR18022002)
NGSSoftware Insight Security Research Advisory Name: Netwin Webnews.exe Systems Affected: IIS4 & IIS5 on Windows NT/2000 Severity: High Risk Vendor URL: http://www.netwinsite.com Author: Mark Litchfield [email protected] Date: 18th February 2002 Advisory number: NISR18022002 Advisory URL:...
CVE-2001-0698
Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command...
CVE-2001-0697
NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service crash via an 'ls ..' command...
CVE-2001-0696
NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service crash via a CD command to a directory with an MS-DOS device name such as con...
CVE-2001-1356
NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021...