CVE-2020-10235: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

Froxlor php object injection vulnerability

Froxlor is a web-based version of the server backend control panel developed by the Froxlor team, which supports a wide range of servers such as Apache, Lighttpd and Nginx. A PHP object injection vulnerability exists in the Domain name form in Froxlor 0.9.39.5 and earlier versions. A remote...

CVE-2018-1000527

Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...

CVE-2018-1000527

Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...

Information disclosure

Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...

CVE-2018-1000527

Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...

CVE-2018-1000527

CVE-2018-1000527 affects Froxlor ≤ 0.9.39.5, describing a PHP Object Injection in the Domain name form that can lead to information disclosure and remote code execution. The attack is reported as exploitable by sending a malicious PHP object via $_POST['ssl_ipandport']; multiple sources corrobora...

CVE-2018-1000527: Deserialization of Untrusted Data

Froxlor version = 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $POST'sslipandport'. This vulnerability appears to...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

Improper access control

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642

Froxlor up to version 0.9.39.5 contains an Incorrect Access Control issue where tickets can be accessed by users who do not own them. The connected Red Hat, SUSE, GHSA, OSV, and CVE records corroborate this vulnerability family. The description does not provide root-cause details or a vendor patc...

CVE-2018-12642

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

CVE-2018-12642: Incorrect Permission Assignment for Critical Resource

Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user...

Froxlor 0.9.37 HTML Injection

Credits: John Page aka HyP3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FROXLOR-0.9.37-HTML-INJECTION.txt + ISR: ApparitionSec Vendor: ============== www.froxlor.org Product: ============= Froxlor 0.9.37 Vulnerability Type: ===================...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

Default configuration

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

CVE-2015-5959 affects Froxlor prior to 0.9.33.2, where default installations could disclose the database password by reading the /logs/sql-error.log file. Multiple sources (NVD entry and FreeBSD VuXML) describe an unauthenticated information-disclosure scenario tied to the /logs directory permiss...

CVE-2015-5959: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...