Priority LOW 24
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01176 · Published 2021-05-05 · No fix listed CWE-79
Priority MEDIUM 52
SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06972 · Published 2020-07-05 · No fix listed
Priority MEDIUM 45
SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01632 · Published 2020-07-05 · No fix listed CWE-20
Priority MEDIUM 45
SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01632 · Published 2020-07-05 · No fix listed
Priority LOW 29
A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.02269 · Published 2019-12-18 · No fix listed CWE-79
Priority LOW 34
A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.06397 · Published 2019-12-16 · No fix listed CWE-79
Priority LOW 35
A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.03233 · Published 2019-12-16 · No fix listed CWE-1236
Priority HIGH 74
A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.65448 · Published 2019-06-17 · No fix listed CWE-78
Priority LOW 35
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SY…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00605 · Published 2019-06-07 · No fix listed CWE-287
Priority MEDIUM 42
SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.08096 · Published 2019-03-17 · No fix listed
Priority LOW 30
SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.05424 · Published 2019-03-17 · No fix listed CWE-79
THREATIST.IORead the docs