CVE-2019-13071

CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page...

CVE-2019-13071

CVE-2019-13071 affects PowerPanel Business Edition 3.4.0 (Agent/Center component). The vulnerability is a CSRF flaw that allows an attacker to submit POST requests to arbitrary forms within the web application by convincing an authenticated user to visit a malicious page. This can enable actions ...

CVE-2019-13071: Cross-Site Request Forgery (CSRF)

CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page...

PowerPanel Business Edition 3.4.0 Cross Site Request Forgery

Exploit Title: PowerPanel Business Edition 3.4.0 - Cross Site Request Forgery Date: 7/9/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Version: 3.4.0 Tested on: Ubuntu 16.04 CVE : CVE-2019-13071 Reported to vendor on 5/25/2019, no acknowledgement. The Agent/Cent...

PT-2019-13109

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0 Description The issue allows an attacker to submit POST requests to any forms in the web application by exploiting a CSRF weakness in the Agent/Center component. This can be achieved by...

CVE-2019-13070

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

CVE-2019-13070

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

Cross site scripting

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

CVE-2019-13070

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

CVE-2019-13070

CVE-2019-13070 is a stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0. The issue allows a privileged attacker to embed malicious JavaScript via the SNMP trap receivers form; when a user visits the /agent/action_recipient Event Action/Recipient ...

CVE-2019-13070: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/actionrecipient Event Action/Recipient page, the embedded code will be...

PT-2019-13108

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0 Description A stored XSS issue in the Agent/Center component allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. This code is executed in the victim's...

PowerPanel Business Edition - Cross-Site Scripting Vulnerability

Exploit for linux platform in category web applications Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Software Link:...

PowerPanel Business Edition 3.4.0 Cross Site Scripting

Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Software Link: https://dl4jz3rbrsfum.cloudfront.net/software/ppbe340-linux-x8664.sh Version:...

PowerPanel Business Edition - Cross-Site Scripting

PowerPanel Business Edition - Cross-Site Scripting Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Version: 3.4.0 Tested on: Ubuntu 16.04 CVE...

PowerPanel Business Edition - Cross-Site Scripting

Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting SNMP trap receivers Google Dork: None Date: 6/29/2019 Exploit Author: Joey Lane Vendor Homepage: https://www.cyberpowersystems.com Version: 3.4.0 Tested on: Ubuntu 16.04 CVE : Pending CyberPower PowerPanel Business Edition...

Product update: Virtuozzo PowerPanel RTM Hotfix 4 (7.0.1-422)

The new packages for Virtuozzo PowerPanel introduce a new feature as well as usability fixes. Vulnerability id: PP-336 Unable to select key combinations from the "Send Key Combination" list when using Mozilla Firefox. Vulnerability id: PP-506 Update could fail due to a package repository conflict...

Important product update: Virtuozzo PowerPanel RTM Hotfix 3 (7.0.1-415)

The new packages for Virtuozzo PowerPanel introducing new features as well as security and usability fixes. Vulnerability id: CVE-2014-3566, PP-427 Disabled SSLv3 access to the management panel to protect against the POODLE SSLv3 vulnerability...

Product update: Virtuozzo PowerPanel RTM Hotfix 2 (7.0.1-354)

The new packages for Virtuozzo PowerPanel introducing usability bug fixes. Vulnerability id: PP-403 Installation of computes failed to complete if 'nodes.lst' had empty lines. Vulnerability id: PP-401 Unable to join computes due to incorrect repository priorities. Vulnerability id: PP-378 Improve...

Important product security update: Virtuozzo PowerPanel RTM Hotfix 1 (7.0.1-346)

The new packages for Virtuozzo PowerPanel introducing a security fix and usability bug fixes. Vulnerability id: PP-312 Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to Virtuozzo PowerPanel in the legacy mode for a VM with such a locked account...