CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

Design/Logic Flaw

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, a directory containing user profile files (including password hashes) is world-readable/writable. An unprivileged Windows user with filesystem access can copy a valid profile to that directory to create an FTP user, potentially gaining read/replace acc...

CVE-2020-35481

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

CVE-2020-35481

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

Cross site scripting

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

Cross site scripting

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

Design/Logic Flaw

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

Directory traversal

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-28001

The CVE-2020-28001 issue affects SolarWinds Serv-U FTP Server (before 15.2.2). The vulnerability arises from improper sanitization/validation of user-supplied directory names in the web application, enabling an authenticated Stored XSS when a crafted directory name is processed (and potentially t...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-27994

CVE-2020-27994 affects SolarWinds Serv-U FTP Server prior to 15.2.2. It is an authenticated directory traversal vulnerability in which the server does not validate path information correctly, allowing a logged-in user to read files outside the user’s home directory via a crafted HTTP GET request....