Default credentials

changepassword.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access...

CVE-2006-0685

The CVE-2006-0685 issue affects VHCS (Virtual Hosting Control System) up to version 2.4.7.1, where the check_login function in login.php does not exit on failed authentication. This enables a remote attacker to bypass authentication and gain unauthorized access to VHCS application scripts. The co...

Virtual Hosting Control System 2.2/2.4 - 'change_password.php' Current Password

source: https://www.securityfocus.com/bid/16600/info Virtual Hosting Control System VHCS is prone to multiple input and access vulnerabilities. VHCS is prone to an HTML-injection vulnerability and an authentication-bypass vulnerability. These issues could be exploited to gain administrative acces...

LinPHA 0.9.x1.0 - sec_stage_install.php Local File Inclusion

LinPHA 0.9.x1.0 - secstageinstall.php Local File Inclusion source: https://www.securityfocus.com/bid/16592/info LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'includeonce' PHP function in...

Sql injection

SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8 allows remote authenticated users to execute arbitrary SQL commands via the 1 GatewayID parameter in an add action in AddGatewaySettings.asp and 2 IP parameter in IPManager.asp...

CVE-2006-0581

SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8 allows remote authenticated users to execute arbitrary SQL commands via the 1 GatewayID parameter in an add action in AddGatewaySettings.asp and 2 IP parameter in IPManager.asp...

CVE-2006-0581

CVE-2006-0581 refers to a SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8. The issue allows remote authenticated users to execute arbitrary SQL commands via the GatewayID parameter in AddGatewaySettings.asp and the IP parameter in IPManager.asp. The available sources confirm the ...

CVE-2006-0581

SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8 allows remote authenticated users to execute arbitrary SQL commands via the 1 GatewayID parameter in an add action in AddGatewaySettings.asp and 2 IP parameter in IPManager.asp...

[Full-disclosure] Re: cPanel Multiple Cross Site Scripting Vulnerability

One more to ur list http://localhost:2095/dowebmailforward.cgi?fwd=3Cscript3Ealert28document.cookie293B3C2Fscript3E&action=Add+Forwarder Sumit On 2/4/06, Hamish Stanaway [email protected] wrote: Hi there, Thank you for finding this vulnerability in a widely used software. I was wondering i...

[SA18731] Hosting Controller SQL Injection Vulnerabilities

TITLE: Hosting Controller SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA18731 VERIFY ADVISORY: http://secunia.com/advisories/18731/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Hosting Controller 6.x http://secunia.com/product/4754/ DESCRIPTION: Soroush...

cpanelXSS.txt

Title: cPanel Multiple Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk Discovered: 22 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Web Hosting Manager Vendor: cPanel Vulnerability: Cross Site Scripting / Cookie-Theft / Relogin attacks...

[Full-disclosure] cPanel Multiple Cross Site Scripting Vulnerability

Title: cPanel Multiple Cross Site Scripting Author: Simo Ben youssef aka 6mOHaCk simoatmorxorg Discovered: 22 january 2005 Published: 02 february 2006 MorX Security Research Team http://www.morx.org Service: Web Hosting Manager Vendor: cPanel Vulnerability: Cross Site Scripting / Cookie-Theft /...

Helm XSS Vulnerability

I.Vulnerability Helm Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Web Host Automation Ltd. www.webhostautomation.com III.Affected Systems Helm v3.2.8 and probably previous versions. IV.About Helm is a multi-server management and hosting control system for Windows 2000 and 20...

hsphereXSS.txt

I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software www.psoft.net III.Affected Systems H-Sphere = 2.4.3 Patch 8 IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD ...

Cross site scripting

Cross-site scripting XSS vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter...

CVE-2006-0211

Cross-site scripting XSS vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter...

CVE-2006-0211

Cross-site scripting XSS vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter...

PT-2006-1288 · Helm · Helm Web Hosting Control Panel

Name of the Vulnerable Software and Affected Versions: Helm Hosting Control Panel versions 3.2.8 and earlier Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the txtEmailAddress parameter in the...

CVE-2006-0193

Cross-site scripting XSS vulnerability in the Hosting Control Panel psoft.hsphere.CP in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action...

CVE-2006-0193

Cross-site scripting XSS vulnerability in the Hosting Control Panel psoft.hsphere.CP in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action...