Two vulnerabilities have been reported in EServ, which can be exploited by a malicious person to disclose directory content and use the system as a proxy.

It is possible to view the directory content of the web root by sending an HTTP request like the following example:
http://[victim]/?

It is possible for a malicious person to configure his browser to use EServ as an anonymous proxy server even though the proxy functionality has been disabled or not installed at all. The HTTP service (port 80/tcp) can be used as a HTTP proxy and the FTP service (port 21/tcp) can be exploited as a FTP proxy.

The vulnerabilities have been confirmed in version 2.99 (two default configurations with and without the proxy server installed), but does reportedly affect prior versions as well (2.95 to 2.99).

Solution
Reportedly, the vendor states that the vulnerabilities are not present in a default configuration.
Further details available to Secunia VIM customers

Provided and/or discovered by
D4rkGr3y

Deep Links
Links available to Secunia VIM customers