PT-2022-23623 · Elfsight · Elsight Halo

Name of the Vulnerable Software and Affected Versions: Elsight Halo affected versions not specified Description: The Elsight Halo web panel allows connection validation through a POST request to /api/v1/nics/wifi/wlan0/ping, which can be exploited by abusing the DESTINATION parameter to achieve...

PT-2022-6101

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1147 Description The issue is related to the login/index.php component in Control Web Panel, which allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login...

The vulnerability of the ajax_mod_security.php implementation of the application for managing servers on CentOS Web Panel allows a hacker to execute arbitrary code.

The vulnerability of the ajaxmodsecurity.php implementation of the application for managing servers on CentOS Web Panel is related to the failure to take measures to eliminate special elements in the string entered by the user when processing the archivo parameter. Exploiting this vulnerability m...

The vulnerability of the server management application CentOS Web Panel lies in improper code generation, allowing attackers to execute arbitrary code.

The vulnerability of the CentOS Web Panel server management application is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created request...

The vulnerability of the server management application CentOS Web Panel lies in improper code generation, allowing attackers to execute arbitrary code.

The vulnerability of the CentOS Web Panel server management application is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created request...

CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-25047

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...

CVE-2022-25048

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user...

Blazer SQL Injection Vulnerability

Blazer is a tool. Allows SQL queries to be executed against a database from a Web panel.A SQL injection vulnerability exists in versions of Blazer prior to 2.6.0, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit this vulnerabili...

Backdoor.Win32.Chubo.c Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c16b04a9879896ef453a6deb13528087.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Chubo.c Vulnerability: Unauthenticated Remote Command Execution Family: Chubo Type:...

Backdoor.Win32.Chubo.c Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c16b04a9879896ef453a6deb13528087B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Chubo.c Vulnerability: Cross Site Scripting XSS Family: Chubo Type: Web Panel MD5:...

Hades RAT Web Panel Information Disclosure Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24B.txt Contact: email protected Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Information Disclosure Description: The Hades Rat web-panel listens on Port 80. There is no authentication check or...

Hades RAT Web Panel Insecure Credential Storage Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt Contact: email protected Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Insecure Credential Storage Family: Hades Type: WebUI MD5: c4cc1317aea42f7dd4a1b786c5278a24 MD5:...

Hades RAT Web Panel Cross Site Scripting Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24C.txt Contact: email protected Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Remote Persistent XSS Family: Hades Type: WebUI MD5: c4cc1317aea42f7dd4a1b786c5278a24 MD5:...

Hades RAT Web Panel Insecure Credential Storage

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Insecure Credential Storage Family: Hades Type: WebUI MD5:...

Hades RAT Web Panel Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Information Disclosure Description: The Hades Rat web-panel...

Control Web Panel bugs cause remote code execution in Linux servers

...

Linux Servers at Risk of RCE Due to Critical CWP Bugs

Researchers have discovered two critical bugs in Control Web Panel CWP – a popular web hosting management software used by 200,000+ servers – that could allow for remote code execution RCE as root on vulnerable Linux servers. CWP, formerly known as CentOS Web Panel, is an open-source Linux contro...

Critical Bugs in Control Web Panel Expose Linux Servers to RCE Attacks

Researchers have disclosed details of two critical security vulnerabilities in Control Web Panel that could be abused as part of an exploit chain to achieve pre-authenticated remote code execution on affected servers. Tracked as CVE-2021-45467, the issue concerns a case of a file inclusion...

PT-2022-3811

Name of the Vulnerable Software and Affected Versions CentOS Web Panel versions prior to 0.9.8.1107 Description The issue is related to incorrect handling of code generation in CentOS Web Panel, allowing a remote attacker to execute arbitrary code using a specially crafted request. An...