202 matches found
Made vesta file contains vulnerabilities
Made vesta is a Made open source application. Made vesta version 0.9.8-24 contains a file inclusion vulnerability, which stems from a lack of filtering and restriction on file references in the web/add/user/index.php file, and can be exploited by attackers to cause file inclusion...
CVE-2021-43693
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
CVE-2021-43693
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
CVE-2021-43693
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
Arbitrary file deletion
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
CVE-2021-43693
Vesta 0.9.8-24 is affected by a file inclusion vulnerability in web/add/user/index.php due to insufficient filtering and restriction on file references. This can be exploited to cause file inclusion, per CVE-2021-43693 and CNVD/CNNVD entries. The documents do not specify exploit details beyond th...
CVE-2021-43693
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...
Made vesta ๅฎๅ จๆผๆด
Made vesta is a Made open source application. Made vesta version 0.9.8-24 contains a file inclusion vulnerability, which stems from a lack of filtering and restriction on file references in the web/add/user/index.php file, and can be exploited by attackers to cause file inclusion...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description Attacker is able to rename any file on the server if logged in user visits attacker website. ๐ต๏ธโโ๏ธ Proof of Concept Create a test.txt file under /home/user when you logged in open this POC.html in a browser you can check test.txt renames to test.php. //PoC.html history.pushState'',...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description The download/web-log endpoint does not have CSRF Protection. This could be used to force download error log and potentially sensitive information leakage. ๐ต๏ธโโ๏ธ Proof of Concept Login to user account. Create the following POC.html file and open the page in browser. To verify that you...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description Attacker is able to "delete" an element from favorite. this vulnerability happens on some sections. for example on โFirewallโ tab list/firewall/ ๐ต๏ธโโ๏ธ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally first record deletes from...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description Attacker is able to add an element to favorite. this vulnerability happens on some sections. for example on โFirewallโ tab list/firewall/ ๐ต๏ธโโ๏ธ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally first record saves as favorite...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description Attacker is able to logout user if a logged in user visits attacker website. ๐ต๏ธโโ๏ธ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally you logged out history.pushState'', '', '/' document.forms0.submit; ๐ฅ Impact This vulnerability is...
Necro Python Malware Upgrades With New Exploits and Crypto Mining Capabilities
New upgrades have been made to a Python-based "self-replicating, polymorphic bot" called Necro in what's seen as an attempt to improve its chances of infecting vulnerable systems and evading detection. "Although the bot was originally discovered earlier this year, the latest activity shows numero...
VulnCheck KEV: CVE-2021-46850
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the vsftplicense parameter when sending HTTP POST requests to the /edit/server endpoint...
CVE-2021-30462
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts...
Vesta Control Panel ่ฎฟ้ฎๆงๅถ้่ฏฏๆผๆด
VestaCP is an open source hosting control panel that can be used to manage multiple websites, create and manage email accounts, FTP accounts and MySQL databases, and manage DNS records. An elevation of privilege vulnerability exists in VestaCP 0.9.8-24 and earlier versions. The vulnerability stem...
Vesta Control Panel ๅ็ฝฎ้พๆฅๆผๆด
VestaCP is an open source hosting control panel that can be used to manage multiple websites, create and manage email accounts, FTP accounts and MySQL databases, and manage DNS records. An elevation of privilege vulnerability exists in VestaCP 0.9.8-24 and earlier versions. The vulnerability can ...