Solarwinds: >> Serv-U >> 15.1.6 Security Vulnerabilities
SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
CVSS Score
6.1
EPSS Score
0.033
Published
2020-07-07
SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
CVSS Score
7.5
EPSS Score
0.029
Published
2020-07-07
SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
CVSS Score
6.1
EPSS Score
0.033
Published
2020-07-07
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
CVSS Score
7.5
EPSS Score
0.029
Published
2020-07-07
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session.
CVSS Score
7.3
EPSS Score
0.014
Published
2018-05-16
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring.
CVSS Score
6.5
EPSS Score
0.015
Published
2018-05-16
Page 3