CVE-2012-3842

Multiple cross-site scripting XSS vulnerabilities in CMDDOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the 1 select0 or 2 select8 parameters...

CVE-2012-3842

CVE-2012-3842 affects JBMC Software DirectAdmin 1.403, with multiple XSS flaws in CMD_DOMAIN that allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the select0 or select8 parameters. The connected PT-2012-5038 entry provides concrete details on af...

DirectAdmin v1.403 - Cross Site Scripting Vulnerability

Title: ====== DirectAdmin v1.403 - Cross Site Scripting Vulnerability Date: ===== 2012-04-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=486 VL-ID: ===== 486 Introduction: ============= DirectAdmin is a graphical web-based web hosting control panel designed to make...

DirectAdmin硬链接本地特权提升漏洞

Bugtraq ID: 47690 DirectAdmin是一款功能强大的虚拟主机在线管理系统。 当创建备份时不正确检查部分硬链接，本地攻击者可以通过硬链接攻击操作部分文件，提升特权。 JBMC Software DirectAdmin 1.33.6 JBMC Software DirectAdmin 1.33.4 JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.381 JBMC...

DirectAdmin 'mysql_backup'文件夹信息泄露漏洞

Bugtraq ID: 47693 DirectAdmin是一款功能强大的虚拟主机在线管理系统。 DirectAdmin把MySQL数据库备份文件创建在全局可读的"mysqlbackups"文件夹中，可导致泄露MySQL数据库备份内容。 要成功利用漏洞需要CustomBuild用于更新MySQL数据库，并且"mysqlbackup"设置为"yes"。 JBMC Software DirectAdmin 1.33.6 JBMC Software DirectAdmin 1.33.4 JBMC Software DirectAdmin 1.33.3 JBMC Software...

Deserialization of untrusted data

CMDDB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action...

Design/Logic Flaw

JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATHINFO to the CMDDB script during a backup action...

CVE-2009-1525

CMDDB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action...

CVE-2009-1526

JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATHINFO to the CMDDB script during a backup action...

CVE-2009-1525

DirectAdmin (JBMC Software) CMD_DB vulnerability CVE-2009-1525 affects DirectAdmin before 1.334. Remote authenticated users can gain privileges by supplying shell metacharacters in the name parameter during a restore action. Root cause involves processing of shell metacharacters in the restore wo...

CVE-2007-1926

CVE-2007-1926 affects JBMC Software DirectAdmin before 1.293. The vulnerability arises because DirectAdmin does not properly display log files, enabling cross-site scripting (XSS) via user-controlled input logged in multiple files (e.g., /var/log/directadmin/security.log, /var/log/messages, /var/...

CVE-2006-5983

Multiple cross-site scripting XSS vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 user parameter to a CMDSHOWRESELLER or b CMDSHOWUSER in the Admin level; the 2 TYPE parameter to c CMDTICKETCREATE or d CMDTICKET...

CVE-2006-5983

Multiple cross-site scripting XSS vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 user parameter to a CMDSHOWRESELLER or b CMDSHOWUSER in the Admin level; the 2 TYPE parameter to c CMDTICKETCREATE or d CMDTICKET...