Login Request a demo
Unscored severity · published Apr 24, 2006
CVE-2006-1951
Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//"…
–
CVSS
4%
EPSS
No
On KEV
Description
Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//" sequences, which are collapsed into "../" sequences by filtering.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tftp Server · Solarwinds
5.0.55_standard; 5.0.60standard; 8.1 · source: NVD
Affected product
TS
Tftp Server
Solarwinds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1951
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1951
archives.neohapsis.com
http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0009.html
secunia.com
http://secunia.com/advisories/19848
securityreason.com
http://securityreason.com/securityalert/778
Patch
http://www.rapid7.com/advisories/R7-0019.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/431729/100/0/threaded
Patch
http://www.securityfocus.com/bid/17648
More from Tftp Server
–
CVE-2010-2310
SolarWinds TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request
–
CVE-2010-2115
SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted read request
–
CVE-2009-3115
SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement (OACK) request
–
CVE-2002-1542
SolarWinds TFTP server 5.0.55 and earlier allows remote attackers to cause a denial of service (crash) via a large UDP datagram, possibly triggering a buffer overflow
–
CVE-2002-1209
Directory traversal vulnerability in SolarWinds TFTP Server 5.0.55, and possibly earlier, allows remote attackers to read arbitrary files via "..\" (dot-dot backslash) sequences…