CVE-2013-4742

CVE-2013-4742 describes a buffer overflow in SurgeFTP Server (NetWin SurgeFTP) prior to version 23d2 triggered during authentication by a long string in the request. The effect is a denial of service (crash) and potentially arbitrary code execution via memory corruption on heap/stack. Root cause:...

CVE-2001-0698

NetWin SurgeFTP (SurgeFTP) versions 2.0a and 1.0b are affected by a directory traversal vulnerability in the nlist command, enabling remote attackers to list files and directories outside the FTP root due to insufficient input validation. CERT reports Surge FTP Server 2.0a allows remote users to ...

CVE-2017-17933

NetWin SurgeFTP 23f2 contains a stored cross-site scripting (XSS) flaw in the Web Manager CGI at cgi/surgeftpmgr.cgi (ports 7021/9021). The vulnerability arises from insufficient input filtering for the classid, domainid, and username parameters, enabling an attacker to inject malicious scripts. ...

CVE-2005-1034

CVE-2005-1034 affects SurgeFTP 2.2m1 and allows a remote attacker to cause a denial of service (application hang) by abusing the non‑standard LEAK command. The underlying issue is how the LEAK command is processed, which can crash the ftp daemon. Public material in the connected sources notes tha...

CVE-2010-1068

The CVE-2010-1068 entry describes multiple cross-site scripting (XSS) vulnerabilities in SurgeFTP 2.3a6, specifically in surgeftpmgr.cgi. The issue enables remote attackers to inject arbitrary web script or HTML via the domainid or classid parameters in a class action. Connected sources identify ...

CVE-2007-3769

CVE-2007-3769 affects SurgeFTP 2.3a1: a reflected XSS in the mirrored server management interface allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response, which is shown in the error message. The note indicates this could be leveraged for root acce...

CVE-2001-0696

NetWin SurgeFTP 2.0a and 1.0b are affected by CVE-2001-0696: a remote attacker can cause a denial of service (crash) by issuing a CD command to a directory named with an MS-DOS device name (e.g., con). The available sources confirm the vulnerability exists and describe the impact as a crash/DoS, ...

CVE-2001-1354

The CVE-2001-1354 entry concerns the NetWin Authentication module (NWAuth) versions 2.0 and 3.0b, as implemented in SurgeFTP and DMail (and possibly other packages). The root cause is weak password hashing used by NWAuth, which could enable local users to decrypt stored passwords or to log in wit...

CVE-2001-1355

Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail and SurgeFTP (and possibly other packages), could allow attackers to execute arbitrary code via long arguments to the -del or -lookup commands. The vulnerability is a result of unsafe handling of l...

CVE-2008-1052

The CVE-2008-1052 entry concerns NetWin SurgeFTP, specifically versions 2.3a2 and earlier. The issue is a remote denial of service: when an attacker sends a crafted large Content-Length HTTP header, memory exhaustion leads to a NULL pointer dereference and a daemon crash. The description does not...

CVE-2001-0697

Technical details are not publicly provided in the supplied documents for CVE-2001-0697. Monitor for updates.

CVE-2007-3768

CVE-2007-3768 affects SurgeFTP 2.3a1, where the mirror mechanism processes PASV replies. A user‑assisted, remote FTP server can trigger a denial of service (restart) via a malformed PASV response. Exploitation specifics are not provided in the connected documents; CVSS base score is 8.5 (HIGH) fr...

CVE-2001-1356

Affected software: NetWin SurgeFTP 2.0f and earlier. Vulnerability: passwords are encrypted with weak hashing, a fixed salt, and modulo 40 arithmetic, enabling remote attackers to perform brute‑force password guessing against the administrator account on port 7021. Impact: attacker could compromi...