CVE-2004-2318

The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of service (crash) via requests with two percent (%) signs in the CMD parameter.

• http://members.lycos.co.uk/r34ct/main/surge_FTP/surge-ftp.txtExploit, Vendor Advisory
• http://securitytracker.com/id?1008898
• http://www.osvdb.org/3788
• http://www.secunia.com/advisories/10758/Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/9554
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15001
• http://members.lycos.co.uk/r34ct/main/surge_FTP/surge-ftp.txtExploit, Vendor Advisory
• http://securitytracker.com/id?1008898
• http://www.osvdb.org/3788
• http://www.secunia.com/advisories/10758/Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/9554
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15001

Published

Dec 31, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-2312Buffer overflow in GNU make for IBM AIX 4.3.3, when installe…
• CVE-2004-2313Inter7 SqWebMail 3.4.1 through 3.6.1 generates different err…
• CVE-2004-2314The Telnet listener for Novell iChain Server before 2.2 Fiel…
• CVE-2004-2315Mbedthis AppWeb HTTP server before 1.0.2 allows remote attac…
• CVE-2004-2316Mbedthis AppWeb HTTP server before 1.0.2 allows remote attac…
• CVE-2004-2317Information leak in Mbedthis AppWeb HTTP server 1.0 through …
• CVE-2004-2319IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows loc…
• CVE-2004-2320The default configuration of BEA WebLogic Server and Express…5.3
• CVE-2004-2321BEA WebLogic Server and Express 8.1 SP1 and earlier allows l…
• CVE-2004-2322SQL injection vulnerability in the (1) announce and (2) note…
• CVE-2004-2323DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d…
• CVE-2004-2324SQL injection vulnerability in DotNetNuke (formerly IBuySpy …