Directory traversal

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-28001

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...

CVE-2020-28001

The CVE-2020-28001 issue affects SolarWinds Serv-U FTP Server (before 15.2.2). The vulnerability arises from improper sanitization/validation of user-supplied directory names in the web application, enabling an authenticated Stored XSS when a crafted directory name is processed (and potentially t...

CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...

CVE-2020-27994

CVE-2020-27994 affects SolarWinds Serv-U FTP Server prior to 15.2.2. It is an authenticated directory traversal vulnerability in which the server does not validate path information correctly, allowing a logged-in user to read files outside the user’s home directory via a crafted HTTP GET request....

CVE-2020-35482

CVE-2020-35482 affects SolarWinds Serv-U FTP Server before v15.2.2, where an authenticated user can trigger a reflected Cross-Site Scripting (XSS) vulnerability in the web context. The vulnerability is linked to SolarWinds Serv-U 15.2.2 release notes as the fix/upgrade path. Connected sources cor...

CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...

CVE-2020-35481

Affected software: SolarWinds Serv-U before version 15.2.2. Issue: Unauthenticated Macro Injection leading to high-impact outcomes (confidentiality, integrity, and availability) per CVSS metrics (CVSS‑3.1: CRITICAL, 9.8). Root cause and exact exploit path are not detailed in the supplied document...

CVE-2020-35481

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

3 New Severe Security Vulnerabilities Found In SolarWinds Software

Cybersecurity researchers on Wednesday disclosed three severe security vulnerabilities impacting SolarWinds products, the most severe of which could have been exploited to achieve remote code execution with elevated privileges. Two of the flaws CVE-2021-25274 and CVE-2021-25275 were identified in...

3 New Severe Security Vulnerabilities Found In SolarWinds Software

Cybersecurity researchers on Wednesday disclosed three severe security vulnerabilities impacting SolarWinds products, the most severe of which could have been exploited to achieve remote code execution with elevated privileges. Two of the flaws CVE-2021-25274 and CVE-2021-25275 were identified in...

SolarWinds Serv-U FTP Server Authorization Issues Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds Corporation. A security vulnerability exists in SolarWinds Serv-U before 15.2.2 Hotfix 1, which stems from a directory containing a user configuration file which includes a user's password...

SolarWinds Serv-U FTP Server 跨站脚本漏洞

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A cross-site scripting vulnerability exists in SolarWinds Serv-U before 15.2.2, which allows reflection of XSS via authentication.No detailed vulnerability details are available at this time...

SolarWinds Serv-U File Server 跨站脚本漏洞

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server before 15.2.2, which stems from a WEB application lacking proper authentication of client data. An authenticated attacker could...

SolarWinds Serv-U File Server Security Vulnerability

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A security vulnerability exists in SolarWinds Serv-U File Server before 15.2.2 that allows unauthenticated macro injection...

SolarWinds Serv-U FTP Server Path Traversal Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. A path traversal vulnerability exists in SolarWinds Serv-U before 15.2.2 that allows authenticated directory traversal...

ysoserial

This is a Java-based tool called ysoserial, which generates payloads that exploit unsafe Java object deserialization. The tool is designed to create payloads that can be used to attack vulnerable Java applications. The tool uses a variety of payloads, including CommonsCollectionsK1,...

Denial of Service Vulnerability in HG220GS-U

The business scope of Fiberhome Communication Technology Co., Ltd. includes fiber optic communication and related communication technology, information technology field, industrial Internet, and technology development in the field of Internet of Things. A denial of service vulnerability exists in...

DEBIAN-CVE-2020-28851

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to be able to parse an HTTP Accept-Language header...

AZL-45033 CVE-2020-28851 affecting package buildah for versions less than 1.41.4-2

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to be able to parse an HTTP Accept-Language header...