CVE-2007-6495: Undefined Security Weakness

incnewuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of directories named 1 db, 2 www, 3 Special, and 4 log at arbitrary locations under the web root via a modified Dirroot parameter in an AddUser action to...

CVE-2007-6503: Undefined Security Weakness

Multiple unspecified vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to 1 import an arbitrary plan via a request to hosting/importhostingplans.asp; or 2 change an arbitrary plan via a request to hosting/AutoSignUpPlans.asp with the a save, b 30,...

CVE-2007-6499: Undefined Security Weakness

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninstall the FrontPage extensions of an arbitrary account via a request to fp2002/UNINSTAL.asp with a "host id IIS value."...

CVE-2007-6494: Improper Input Validation

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with a username in the reseller parameter, followed by a request to AdminSettings/displays.asp with the DecideAction and ChangeSkin parameters...

CVE-2007-6498: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 email and 2 loginname parameters to Hosting/Addreseller.asp, 3 the sortfield parameter to accounts/accountmanager.asp, 4 the...

CVE-2007-6501: Undefined Security Weakness

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type" via a request to adminsettings/choosetranstype.asp...

CVE-2007-6496: Undefined Security Weakness

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Hosting Controller 6.1 Hot fix <= 3.3 Multiple Remote Vulnerabilities

No description provided by source. Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary...

hc-multi.txt

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From...

Hosting Controller 6.1 Hot fix <= 3.3 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== Hosting Controller 6.1 Hot fix = 3.3 Multiple Remote Vulnerabilities ===================================================================== Title: Multiple Security Bugs ...

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

CVE-2006-6814

CVE-2006-6814 describes a directory traversal vulnerability in FolderManager/FolderManager.aspx (Hosting Controller 7c). The flaw allows remote authenticated users to read and modify arbitrary files and to list arbitrary directories by sending ..\ sequences in the BrowsePath parameter. This resul...

CVE-2006-6814: Undefined Security Weakness

Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\ dot dot backslash sequences in the BrowsePath parameter...

Hosting Controller 7C - FolderManager.aspx Directory Traversal

Hosting Controller 7C - FolderManager.aspx Directory Traversal source: https://www.securityfocus.com/bid/21786/info Hosting Controller is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to modi...

Hosting Controller 7C - 'FolderManager.aspx' Directory Traversal

source: https://www.securityfocus.com/bid/21786/info Hosting Controller is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to modify or retrieve arbitrary files in the context of the webserver...

[SA22607] Hosting Controller Multiple Vulnerabilities

TITLE: Hosting Controller Multiple Vulnerabilities SECUNIA ADVISORY ID: SA22607 VERIFY ADVISORY: http://secunia.com/advisories/22607/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: Hosting Controller 6.x http://secunia.com/product/4754/...

CVE-2006-5629

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in 1 DisableForum.asp and 2 enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and...

CVE-2006-5630

Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to 1 delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and 2 create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum...