Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the 1 overkill, 2 futils, or 3 edit actions...

Cross site scripting

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

CVE-2008-4448

CVE-2008-4448 describes a CSRF vulnerability in actions.php of Positive Software H-Sphere WebShell 4.3.10. An attacker can induce an admin to perform unauthorized actions by visiting a crafted link or IMG tag targeting (1) overkill, (2) futils, or (3) edit actions, effectively enabling file delet...

CVE-2008-4448

Cross-site request forgery CSRF vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the 1 overkill, 2 futils, or 3 edit actions...

CVE-2008-4447

CVE-2008-4447 is a documented XSS vulnerability in Positive Software H-Sphere WebShell 4.3.10, exploitable via (1) fn in dload, (2) mask in search, or (3) tab in sysinfo within actions.php. The connected sources confirm the affected product/version and the vulnerable parameters, establishing a cr...

dovecot -- ACL plugin bypass vulnerabilities

Timo Sirainen reports in dovecot 1.1.4 release notes: ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working...

PT-2008-05: VMware Multiple Products vmci.sys Privilege Escalation Vulnerability

Positive Technologies Research Team has discovered priviliege escalation vulnerabilities in VMware products. The IOCTL handler in vmci.sys does not properly validate buffer data associated with the Irp object, which allows local users with administrative priviligies to gain SYSTEM privilieges...

PT-2008-07: VMware Multiple Products hcmon.sys Denial of Service Vulnerability

Positive Technologies Research Team has discovered denial of service vulnerabilities in VMware products. The IOCTL handler in hcmon.sys does not properly validate buffer data associated with the Irp object, which allows local users with administrative priviligies to crash the system. Solution...

Kiwi CatTools TFTP <= 3.2.8 Remote Path Traversal Vulnerability

No description provided by source. Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which can be used ...

Kiwi CatTools TFTP 3.2.8 - Directory Traversal

Kiwi CatTools TFTP 3.2.8 - Directory Traversal Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which...

CVE-2006-6382

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained...

PT-2006-4143 · Phorum · Phorum

Name of the Vulnerable Software and Affected Versions: Phorum versions 5.1.14 and earlier Description: A SQL injection issue in the search.php file allows remote attackers to potentially execute arbitrary SQL commands via the page parameter. However, the vendor disputes this report, stating that...

gnupg -- false positive signature verification

Werner Koch reports: The Gentoo project identified a security related bug in GnuPG. When using any current version of GnuPG for unattended signature verification e.g. by scripts and mail programs, false positive signature verification of detached signatures may occur. This problem affects the too...

hsphereXSS.txt

I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software www.psoft.net III.Affected Systems H-Sphere = 2.4.3 Patch 8 IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD ...

CVE-2006-0193

CVE-2006-0193 is an XSS vulnerability in the Hosting Control Panel (psoft.hsphere.CP) of Positive Software H-Sphere, affecting version 2.4.3 Patch 8 and earlier. The issue arises from a flaw in the login action where the login parameter can be exploited to inject arbitrary web script/HTML. The NV...

M.Neset KABAKLI

I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software www.psoft.net III.Affected Systems H-Sphere = 2.4.3 Patch 8 IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD ...

CVE-2005-4261

Unspecified vulnerability in Positive Software Corporation CP+ cpplus before 2.5.5 allows attackers to have unknown impact and attack vectors, related to "a possible security flaw caused by a bug in Perl." NOTE: unless CP+ includes its own copy of Perl with CVE-2005-3962, this is a different...

CVE-2005-4261

Unspecified vulnerability in Positive Software Corporation CP+ cpplus before 2.5.5 allows attackers to have unknown impact and attack vectors, related to "a possible security flaw caused by a bug in Perl." NOTE: unless CP+ includes its own copy of Perl with CVE-2005-3962, this is a different...

CVE-2005-4261

Technical details about CVE-2005-4261 (CP+ before 2.5.5) are not provided in the connected documents. The material references Perl-related issues (CVE-2005-3962) and general advisories, but there is no explicit information here on CP+, vendor, affected versions, root cause, impact, or fixes. Moni...

The most classic hack introductory textbook-vulnerability warning-the black bar safety net

The first section, hack the type and behavior of the To my understanding, the“hackers”generally should be divided into“positive”and“evil”Categories, the decent hackers rely on their own knowledge to help system administrators to identify system vulnerabilities and be improved, while the evil...