CVE-2006-6548

Multiple cross-site scripting XSS vulnerabilities in cPanel WebHost Manager WHM 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to 1 scripts2/changeemail, 2 scripts2/limitbw, or 3 scripts/rearrangeacct. NOTE: the feature parameter to...

[Aria-Security Team] CentOS 4.2 i686 - WHM X v3.1.0 Cross-Site Scripting

cAria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory: http://www.aria-security.com/forum/showthread.php?t=44 ----------------------------------------------------------- Software: WebHost Manager WHM Tested WHM X v3.1.0 demo.cpanel.net...

aria-whm.txt

cAria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=44 ----------------------------------------------------------- Software: WebHost Manager WHM Tested WHM X v3.1.0 demo.cpanel.net Poc: http://target:2086/scripts2/changeemail?domain=dXSS...

CVE-2006-6198

Multiple cross-site scripting XSS vulnerabilities in cPanel WebHost Manager WHM 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 email parameter to a scripts2/dochangeemail, the 2 supporturl parameter to b cgi/addonconfigsupport.cgi, the 3 pkg parameter to c...

CVE-2006-6198

CVE-2006-6198 documents multiple XSS vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0. The flaws enable remote authenticated users to inject arbitrary web script or HTML via several parameters in the web UI: (1) email in scripts2/dochangeemail, (2) supporturl in cgi/addon_configsupport.cgi, ...

aria-webhost.txt

Aria-Security Team Advisory Original Advisory: http://www.aria-security.com/forum/showthread.php?t=44 ----------------------------------------------------------- Software: WebHost Manager WHM Tested WHM X v3.1.0 demo.cpanel.net Poc:...

CVE-2006-5535

Multiple cross-site scripting XSS vulnerabilities in WebHostManager WHM 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the 1 theme parameter to scripts/dosetmytheme and the 2 template parameter to scripts2/editzonetemplate...

CVE-2006-5535

CVE-2006-5535 describes multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 and related cPanel 10.9.0 R50. The flaws allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and (2) template parameter to scrip...

WHM 10.8.0 cPanel 10.9.0 R50 CentOS 4.4 i686 WHM X v3.1.0 Xss Vulnerability

WHM 10.8.0 cPanel 10.9.0 R50 CentOS 4.4 i686 WHM X v3.1.0 Xss Vulnerability By CrackersChild crackerschild at sibersavascilar dot com email concealed www.sibersavacilar.com Exploit site.com:2082/scripts/dosetmytheme?theme=XssCodes site.com:2082/scripts2/editzonetemplate?template=XssCodes Examples...

cPanel10.9.0R50.txt

WHM 10.8.0 cPanel 10.9.0 R50 CentOS 4.4 i686 WHM X v3.1.0 Xss Vulnerability By CrackersChild [email protected] www.sibersavacilar.com Exploit site.com:2082/scripts/dosetmytheme?theme=XssCodes site.com:2082/scripts2/editzonetemplate?template=XssCodes Examples...

WHMCompleteSolution XSS vuln.

WHMCompleteSolution XSS vuln. Vuln. dicovered by : r0t Date: 14 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/whmcompletesolution-xss-vuln.html vendor:http://www.whmcs.com/ affected version:2.1 and prior Product Description: WHMCompleteSolution has the features that all web hosts...

CVE-2005-3687

cancelaccount.php in WHM AutoPilot 2.5.30 and earlier allows remote attackers to cancel requests for arbitrary accounts via a modified c parameter...

CVE-2005-3687

CVE-2005-3687 affects WHM AutoPilot 2.5.30 and earlier. A flaw in cancel_account.php lets remote attackers cancel requests for arbitrary accounts by modifying the c parameter. The NVD metrics indicate a NETWORK attack with LOW complexity, requiring no authentication, causing PARTIAL integrity imp...

CVE-2005-3687

cancelaccount.php in WHM AutoPilot 2.5.30 and earlier allows remote attackers to cancel requests for arbitrary accounts via a modified c parameter...

[Full-disclosure] WMH AutoPilot: Unauthorized hosting account cancellation request

Title: WMH AutoPilot: Unauthorized hosting account cancellation request Access: Remote Product: WHM AutoPilot http://www.whmautopilot.com Severity: Moderately Low Synopsis: A vulnerability has been identified that allows the unauthorized filing of hosting account cancellation requests. Vulnerable...

CVE-2004-2524

clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogine and base64encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form...

CVE-2004-2524

CVE-2004-2524 affects Benchmark Designs’ WHM AutoPilot 2.4.5 and earlier. The vulnerability arises when clogin.php uses clogin_e and base64_encode to encode the target user ID in the c parameter, allowing remote attackers to read plaintext usernames and passwords from the resulting form. The desc...

CVE-2004-1422

CVE-2004-1422 : WHM AutoPilot

CVE-2004-1422

WHM AutoPilot 2.4.6.5 and earlier allows remote attackers to gain sensitive information via phpinfo, which reveals php settings...

CVE-2004-1420

Multiple cross-site scripting XSS vulnerabilities in header.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 sitetitle or 2 httpimages parameter...