| Package | Affected versions | Patched versions |
|---|---|---|
| dmail | = 2.5d= 2.7= 2.7q= 2.7r= 2.8e= 2.8f= 2.8g= 2.8h= 2.8i | |
| surgeftp | = 1.0b= 2.0a= 2.0b |
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free