Netwin vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2012-10028 Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary sysHigh 8.6 · Aug 5, 2025
• CVE-2013-4742 Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long stringHigh 7.5 · Aug 9, 2013
• CVE-2008-1497 Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguHigh 9 · Mar 25, 2008
• CVE-2008-1498 Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long fHigh 9 · Mar 25, 2008
• CVE-2008-1055 Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a dHigh 7.5 · Feb 27, 2008
• CVE-2007-4372 Unspecified vulnerability in NetWin SurgeMail 38k on Windows Server 2003 has unknown impact and remote attack vectors.High 10 · Aug 16, 2007
• CVE-2007-3768 The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV commanHigh 8.5 · Jul 15, 2007
• CVE-2007-2655 Unspecified vulnerability in NetWin Webmail 3.1s-1 in SurgeMail before 3.8i2 has unknown impact and remote attack vectors, possibly a format string vulnerabilitHigh 7.5 · May 14, 2007
• CVE-2006-5100 PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote attackers to execute arbitrary PHP code viaHigh 7.5 · Oct 3, 2006
• CVE-2005-1478 Format string vulnerability in dSMTP (dsmtp.exe) in DMail 3.1a allows remote attackers to execute arbitrary code via format string specifiers in the xtellmail cHigh 7.5 · May 11, 2005
• CVE-2005-1516 DList (dlist.exe) in DMail 3.1a allows remote attackers to bypass authentication, read log files, and shutdown the system via a sendlog command with an incorrecHigh 7.5 · May 11, 2005
• CVE-2004-2254 SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration interface via a direHigh 7.5 · Dec 31, 2004
• CVE-2004-2537 Unspecified vulnerability in SurgeMail before 2.2c10 has unknown impact and attack vectors, related to a "Webmail security bug."High 10 · Dec 31, 2004
• CVE-2002-0290 Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument.High 7.5 · May 31, 2002
• CVE-2002-0310 Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attaHigh 7.5 · May 31, 2002
• CVE-2001-1356 NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct High 10 · Aug 4, 2001
• CVE-2001-1355 Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackerHigh 10 · Jul 20, 2001
• CVE-2000-0490 Buffer overflow in the NetWin DSMTP 2.7q in the NetWin dmail package allows remote attackers to execute arbitrary commands via a long ETRN request.High 10 · Jun 1, 2000
• CVE-2000-0422 Buffer overflow in Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.High 7.5 · May 4, 2000