https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-6624.htmlhttps://patchthecve.com/cve/CVE-2006-6624.htmlTue, 16 Jun 2026 22:33:29 +0000MEDIUM 4.0: The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) via a long series of "./" sequences in the SIZE command.https://patchthecve.com/cve/CVE-2005-3506.htmlhttps://patchthecve.com/cve/CVE-2005-3506.htmlTue, 16 Jun 2026 22:17:05 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in proxy.asp in Sambar Server 6.3 BETA 2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the (1) Remote Proxy Server or (2) Proxy Filter IPs field.https://patchthecve.com/cve/CVE-2004-2565.htmlhttps://patchthecve.com/cve/CVE-2004-2565.htmlTue, 16 Jun 2026 22:09:53 +0000MEDIUM 5.0: Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administrative IP address restrictions have been modified from the default, allow remote authenticated users to read arbitrary files via (1) a "..\" (dot dot backslash)https://patchthecve.com/cve/CVE-2004-2564.htmlhttps://patchthecve.com/cve/CVE-2004-2564.htmlTue, 16 Jun 2026 22:09:53 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in show.asp and (2) the title parameter in showperf.asp.https://patchthecve.com/cve/CVE-2004-2086.htmlhttps://patchthecve.com/cve/CVE-2004-2086.htmlTue, 16 Jun 2026 22:08:58 +0000MEDIUM 5.0: Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a long query parameter.https://patchthecve.com/cve/CVE-2003-1287.htmlhttps://patchthecve.com/cve/CVE-2003-1287.htmlTue, 16 Jun 2026 22:03:51 +0000MEDIUM 4.6: Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name such as com1.pl, con.pl, or aux.pl, which causes Perl to read the code from the associated device.https://patchthecve.com/cve/CVE-2003-1286.htmlhttps://patchthecve.com/cve/CVE-2003-1286.htmlTue, 16 Jun 2026 22:03:51 +0000HIGH 7.5: HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface and external web servers, by making a "Connection: keep-alive" request before the proxy requests.https://patchthecve.com/cve/CVE-2003-1285.htmlhttps://patchthecve.com/cve/CVE-2003-1285.htmlTue, 16 Jun 2026 22:03:51 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) isapi/testisa.dll, (2) testcgi.exe, (3) environ.pl, (4) the query parameter to samples/search.dll, (5) the price parameter https://patchthecve.com/cve/CVE-2002-0737.htmlhttps://patchthecve.com/cve/CVE-2002-0737.htmlTue, 16 Jun 2026 21:58:02 +0000MEDIUM 6.4: Sambar web server before 5.2 beta 1 allows remote attackers to obtain source code of server-side scripts, or cause a denial of service (resource exhaustion) via DOS devices, using a URL that ends with a space and a null character.https://patchthecve.com/cve/CVE-2002-0128.htmlhttps://patchthecve.com/cve/CVE-2002-0128.htmlTue, 16 Jun 2026 21:56:51 +0000HIGH 7.5: cgitest.exe in Sambar Server 5.1 before Beta 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long argument.https://patchthecve.com/cve/CVE-2001-1292.htmlhttps://patchthecve.com/cve/CVE-2001-1292.htmlTue, 16 Jun 2026 21:55:58 +0000HIGH 7.5: Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.https://patchthecve.com/cve/CVE-2001-1106.htmlhttps://patchthecve.com/cve/CVE-2001-1106.htmlTue, 16 Jun 2026 21:55:35 +0000HIGH 7.5: The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure.https://patchthecve.com/cve/CVE-2001-1010.htmlhttps://patchthecve.com/cve/CVE-2001-1010.htmlTue, 16 Jun 2026 21:55:24 +0000MEDIUM 5.0: Directory traversal vulnerability in pagecount CGI script in Sambar Server before 5.0 beta 5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) attack on the page parameter.https://patchthecve.com/cve/CVE-2000-0835.htmlhttps://patchthecve.com/cve/CVE-2000-0835.htmlTue, 16 Jun 2026 21:52:33 +0000MEDIUM 5.0: search.dll Sambar ISAPI Search utility in Sambar Server 4.4 Beta 3 allows remote attackers to read arbitrary directories by specifying the directory in the query parameter.https://patchthecve.com/cve/CVE-2000-0509.htmlhttps://patchthecve.com/cve/CVE-2000-0509.htmlTue, 16 Jun 2026 21:51:53 +0000HIGH 10.0: Buffer overflows in the finger and whois demonstration scripts in Sambar Server 4.3 allow remote attackers to execute arbitrary commands via a long hostname.https://patchthecve.com/cve/CVE-2000-0213.htmlhttps://patchthecve.com/cve/CVE-2000-0213.htmlTue, 16 Jun 2026 21:51:14 +0000MEDIUM 5.0: The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.https://patchthecve.com/cve/CVE-1999-1523.htmlhttps://patchthecve.com/cve/CVE-1999-1523.htmlTue, 16 Jun 2026 21:50:37 +0000HIGH 7.5: Buffer overflow in Sambar Web Server 4.2.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP GET request.