Search
Total
11 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-40053 | 1 Solarwinds | 1 Serv-u | 2023-12-28 | N/A | 5.0 MEDIUM |
| A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously. | |||||
| CVE-2021-35249 | 1 Solarwinds | 1 Serv-u | 2022-05-26 | 4.0 MEDIUM | 4.3 MEDIUM |
| This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed. | |||||
| CVE-2021-32604 | 1 Solarwinds | 1 Serv-u | 2022-05-13 | 3.5 LOW | 5.4 MEDIUM |
| Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS." | |||||
| CVE-2021-35247 | 1 Solarwinds | 1 Serv-u | 2022-02-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U. | |||||
| CVE-2021-35245 | 2 Microsoft, Solarwinds | 2 Windows, Serv-u | 2021-12-07 | 6.8 MEDIUM | 6.8 MEDIUM |
| When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. | |||||
| CVE-2020-28001 | 1 Solarwinds | 1 Serv-u | 2021-02-25 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS. | |||||
| CVE-2020-27994 | 1 Solarwinds | 1 Serv-u | 2021-02-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal. | |||||
| CVE-2020-35482 | 1 Solarwinds | 1 Serv-u | 2021-02-04 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS. | |||||
| CVE-2020-15573 | 1 Solarwinds | 1 Serv-u | 2020-07-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. | |||||
| CVE-2020-15575 | 1 Solarwinds | 1 Serv-u | 2020-07-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. | |||||
| CVE-2018-10241 | 1 Solarwinds | 1 Serv-u | 2018-06-20 | 4.0 MEDIUM | 6.5 MEDIUM |
| A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring. | |||||