CVE-2018-6362

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

CVE-2018-6619

Easy Hosting Control Panel EHCP v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt...

CVE-2018-6617

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

PT-2018-17505

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows for XSS via the domainop action parameter. This can be exploited to read sensitive information, such as the PHPSESSID cookie. Recommendations For Easy Hosting Contr...

PT-2018-17673

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue makes it easier for attackers to crack database passwords by leveraging the use of a weak hashing algorithm without a salt. Recommendations For Easy Hosting Control Panel...

PT-2018-17671

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows attackers to change passwords of arbitrary database users when using a local MySQL server. This is due to the failure to ask for the current password, which enables...

CVE-2018-6458: Cross-Site Request Forgery (CSRF)

Easy Hosting Control Panel EHCP v0.37.12.b allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...

CVE-2018-6618: Insufficiently Protected Credentials

Easy Hosting Control Panel EHCP v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage...

CVE-2018-6619: Use of a Broken or Risky Cryptographic Algorithm

Easy Hosting Control Panel EHCP v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt...

CVE-2018-6361: Improper Neutralization of Input During Web Page Generation

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account...

CVE-2018-6617: Improper Authentication

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

CVE-2018-6362: Improper Neutralization of Input During Web Page Generation

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

PT-2018-17672

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows attackers to obtain sensitive information by leveraging cleartext password storage. Recommendations For Easy Hosting Control Panel EHCP version 0.37.12.b, consider...

PT-2018-17504

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows for XSS via the op parameter. This can be exploited by adding a backdoor FTP account. Recommendations For Easy Hosting Control Panel EHCP version 0.37.12.b, avoid...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-09388)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS version 7.0. A remote attacker can add Column with the help of /admincp.php?app=articlecategory&do=save&frame=iPHP to exploit the...

PT-2018-17556

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks due to a lack of CSRF protection. Recommendations For Easy Hosting Control Panel EHCP version...

Easy Hosting Control Panel 0.37.12.b Cross Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-MULTIPLE-CSRF.txt + ISR: Apparition Security Greetz: indoushka|Eduardo|Dirty0tis Vendor: ======== www.ehcp.net Product: ========= Easy Hosting Control Panel v0.37.12.b Ehcp...

Easy Hosting Control Panel 0.37.12.b Cross Site Scripting Add FTP Account

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-FTP-BACKDOOR-ACCOUNT.txt + ISR: Apparition Security Greetz: indoushka|Eduardo|Dirty0tis Vendor: ============= www.ehcp.net Product: =========== Easy Hosting Control...

Vesta Control Panel Cross-Site Scripting Vulnerability (CNVD-2018-09183)

Vesta Control Panel is an open source web hosting control panel. A cross-site scripting vulnerability exists in Vesta Control Panel version 0.9.8-20. A remote attacker can exploit this vulnerability by sending the 'path' parameter to the view/file/index.php URI to execute PHP code...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...