SE
File Transfer
Serv-U
On CISA KEVExploited in the wildRansomware-linked
55
CVEs
4
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 19High 20Medium 16Low 0
Watch
Add Serv-U to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-35247 In wildKEV | 5.3 | Jan 7 | Improper Input Validation Vulnerability in Serv-U Affected: 15.2.5 and previous versions before 15.3 |
| CVE-2021-35245 | 6.8 | Dec 6 | When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine Affected: before 15.2.4; 15.2.4; 15.2.5 |
| CVE-2020-27994 | 6.5 | Feb 3 | SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal Affected: before 15.2.2 |
| CVE-2018-10241 | 6.5 | May 16 | A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially… Affected: through 15.1.6 |
| CVE-2026-28315 | 6.2 | Jul 21 | SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability Affected: 15.5.4 HF1 and below |
| CVE-2020-15575 | 6.1 | Jul 7 | SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194 Affected: before 15.2.1 |
| CVE-2020-15573 | 6.1 | Jul 7 | SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421 Affected: before 15.2.1 |
| CVE-2024-45712 | 5.4 | Apr 15 | SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability Affected: before 15.5.1 |
| CVE-2022-38106 | 5.4 | Dec 16 | This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1 Affected: 15.3.0; 15.3.1 |
| CVE-2021-32604 | 5.4 | May 11 | Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS." Affected: before 15.2.3 |
| CVE-2020-35482 | 5.4 | Feb 3 | SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS Affected: before 15.2.2 |
| CVE-2020-28001 | 5.4 | Feb 3 | SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS Affected: before 15.2.2 |
| CVE-2023-40053 | 5.0 | Dec 6 | A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used… Affected: 15.4.0; 15.4.0; 15.4.0 |
| CVE-2024-28072 | 4.9 | May 3 | A highly privileged account can overwrite arbitrary files on the system with log output Affected: before 15.4.2; 15.4.2 |
| CVE-2021-35249 | 4.3 | May 17 | This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to Affected: before 15.3.1 |
| CVE-2024-45714 | 4.1 | Oct 16 | Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload Affected: through 15.4.2.3 |
Showing 16