Another vulnerability in hosting controller

1/If admin doesn't change or delete user AdvWebadmin, the default password of this user is advcomm500349, you can creat your own account or use this account to hack the server. 1/ A foolish vulnerability, i can view the harddisk by using the file browse.asp in directory admin...

Hosting Controller 1.x - 'Browse.asp' File Disclosure

source: https://www.securityfocus.com/bid/4778/info Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems. The 'browse.asp' script is prone to an issue which may allow a remote attacker to view...

Hosting Controller 1.4 - Import Root Directory Command Execution

Hosting Controller 1.4 - Import Root Directory Command Execution source: https://www.securityfocus.com/bid/4761/info Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems. The Import Root...

Hosting Controller 1.x - DSNManager Directory Traversal

source: https://www.securityfocus.com/bid/4759/info Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems. The DSNManager script does not sufficiently filter dot-dot-slash ../ sequences from URL...

Hosting Controller 1.x - DSNManager Directory Traversal

Hosting Controller 1.x - DSNManager Directory Traversal source: https://www.securityfocus.com/bid/4759/info Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems. The DSNManager script does not...

Hosting Controller 1.4 - Import Root Directory Command Execution

source: https://www.securityfocus.com/bid/4761/info Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems. The Import Root Directory improotdir.asp script does not force an authentication...

CVE-2002-0212

The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack...

CVE-2002-0212

The CVE-2002-0212 issue affects Hosting Controller 1.1–1.4.1, where login error messages differ between valid and invalid usernames, enabling remote enumeration of valid accounts and facilitating brute-force attempts. Root cause: inconsistent authentication responses revealing user existence. Imp...

CVE-2002-0212

The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack...

Hosting Directory Traversal madness...

Hosting Controller directory traversal /../ madness Date 03/14/2002 Some hosting providers mailed me and asked me to do a bit more researches about Hosting Controller, they said their clients' sites have been deleted mysteriously, and defacement still happens quite at large even though they have...

[ARL02-A01] Vulnerability in Hosting Controller

+/--------------------- ALPER Research Labs --------/--- --------/+ +/--------------------- Security Advisory -------/---------- --/+ +/--------------------- ID: ARL02-A01 ------/----------- --/+ +/--------------------- [email protected] -----/------- -------/+ Advisory Information...

hosting.controller.txt

Hi, Here's my new advisory about Hosting Controller. Phuong Hosting Controller - Multiple vulnerabilities Date: 01/04/2002 Summary ------- Hosting Controller is an all-in-one administrative hosting tool for Windows. It automates a wide range of hosting tasks and provides control of each hosted si...

Hosting Controller's - Multiple Security Vulnerabilities

Hosting Controller - Multiple security vulnerabilities Release Date: 01/04/2002 Summary Hosting Controller is an all in one administrative hosting tools for Windows. It automates all hosting tasks and gives full control of each website to the respective owners. Hosting Controller is used widely b...

IMail Web Service User Aliases / Mailing Lists Admin Vulnerability

IMail Web Service User Aliases / Mailing Lists Admin Vulnerability Date : January 1, 2002 Author : Zeeshan Mustafa [email protected] Application : IPSwitch IMail Web Service Versions Test : 7.05/7.04/7.03/7.02/7.01/6.x Exploitable : Remote Vendor Status : Notified Impact of vulnerability :...

twlc advisory: plesk (psa) allows reading of .php files

twlc security divison 21/12/2001 plesk psa allows reading of .php files Found by: supergate ./twlc Summary: Plesk is a server admnistrator used by LOTS of web hosting companies to make easy the menagement of the server. Its a really cool software!! i work with it. This bug allows you to read the...

Sapio WebReflex 1.55 - GET Denial of Service

Sapio WebReflex 1.55 - GET Denial of Service source: https://www.securityfocus.com/bid/2425/info WebReflex is a software package designed to operate a HTTP server off a cdrom, providing web hosting on Microsoft Windows systems. It is written and maintained by Sapio Design Ltd. A problem with the...

Security problems with TWIG webmail system

Twig is a popular webmail system written in PHP, once called Muppet. Author: Christopher Heschong Homepage: http://twig.screwdriver.net Version: 2.5.1 latest Problem: The possibility of processing our own php file , can leed to arbitrary command execution on the server as the httpd user. Status:...

IIS ASP $19.95 hack - IISHack 1.5

IIS ASP $19.95 hack - IISHack 1.5 Release Date: November 3rd, 2000 Systems Affected: Windows NT 4.0 IIS 4.0 sp6 vulnerable Windows NT 5.0 IIS 5.0 not vulnerable Description: There exists a buffer overflow, that can be exploited to gain SYSTEM level access, within the IIS Internet Information Serv...

CVE-2000-1204

Vulnerability in the modvhostalias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root...

Apache Httpd < 1.3.14 : Mass virtual hosting can display CGI source

A security problem for users of the mass virtual hosting module, modvhostalias, causes the source to a CGI to be sent if the cgi-bin directory is under the document root. However, it is not normal to have your cgi-bin directory under a document root...