CVE-2006-6382

CVE-2006-6382 affects Positive Software H-Sphere prior to 2.5.0 RC3. The control panel creates log files in a user’s directory with insecure permissions, enabling local users to append log data to arbitrary files via a symlink attack. The description notes the provenance is from third‑party infor...

CVE-2006-6382

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained...

H-Sphere WebShell 2.x - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20532/info H-Sphere WebShell is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in th...

CVE-2006-3278

CVE-2006-3278 is an XSS vulnerability in H-Sphere 2.5.1 Beta 1 and earlier. Triggered via parameters next_template, start, curr_menu_id, and arid in psoft/servlet/resadmin/psoft.hsphere.CP when using the mailman/massmail.html template_name, potentially allowing remote attackers to inject arbitrar...

CVE-2006-3278

Cross-site scripting XSS vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 nexttemplate, 2 start, 3 currmenuid, and 4 arid parameters in psoft/servlet/resadmin/psoft.hsphere.CP when using the mailman/massmail.html...

H-Sphere 2.5.1 - Multiple Cross-Site Scripting Vulnerabilities

H-Sphere 2.5.1 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/18677/info H-Sphere is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

H-Sphere 2.5.1 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/18677/info H-Sphere is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in th...

hsphereXSS.txt

I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software www.psoft.net III.Affected Systems H-Sphere = 2.4.3 Patch 8 IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD ...

Cross site scripting

Cross-site scripting XSS vulnerability in the Hosting Control Panel psoft.hsphere.CP in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action...

CVE-2006-0193

Cross-site scripting XSS vulnerability in the Hosting Control Panel psoft.hsphere.CP in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action...

CVE-2006-0193

CVE-2006-0193 is an XSS vulnerability in the Hosting Control Panel (psoft.hsphere.CP) of Positive Software H-Sphere, affecting version 2.4.3 Patch 8 and earlier. The issue arises from a flaw in the login action where the login parameter can be exploited to inject arbitrary web script/HTML. The NV...

M.Neset KABAKLI

I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software www.psoft.net III.Affected Systems H-Sphere = 2.4.3 Patch 8 IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD ...

CVE-2003-1248

H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 mode and 2 zipfile parameters in a URL request...

CVE-2003-1247

CVE-2003-1247 concerns multiple buffer overflows in H-Sphere WebShell 2.3. The flaw allows remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile, (2) a long path in diskusage, and (3) a long fname in flist. Documents do not specify affected vendor/product ver...

CVE-2003-1248

CVE-2003-1248 affects H-Sphere WebShell 2.3. The vulnerability allows remote command execution by passing shell metacharacters in the mode and zipfile URL parameters. Impact is partial confidentiality, integrity, and availability. No explicit exploitation status is provided in the documents; expl...

CVE-2003-1247

Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via 1 a long URL content type in CGI::readFile, 2 a long path in diskusage, and 3 a long fname in flist...

CVE-2005-1606

H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, which allows local users to gain privileges...

CVE-2005-1605

Cross-site scripting XSS vulnerability in the guestbook for SiteStudio 1.6 allows remote attackers to inject arbitrary web script or HTML via the name field to 1 psoft.guestbook.GuestBookServ in Standalone Site Studio or 2 E-Guestsign.pl in Integrated Site Studio with H-Sphere...

CVE-2005-1606

CVE-2005-1606 affects H-Sphere Winbox 2.4.2 and 2.4.3 RC1. The underlying issue is that usernames and passwords are stored in plaintext in world-readable log files, enabling local users to gain privileges. The documents do not provide explicit exploit details, affected components beyond the log l...

CVE-2005-1605

The entry CVE-2005-1605 describes a Cross-site Scripting (XSS) vulnerability in the guestbook of SiteStudio 1.6, exploitable via the name field to either psoft.guestbook.GuestBookServ (Standalone Site Studio) or E-Guest_sign.pl (Integrated Site Studio with H-Sphere). The vulnerability is triggere...