Default credentials

changepassword.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access...

CVE-2006-0685

The CVE-2006-0685 issue affects VHCS (Virtual Hosting Control System) up to version 2.4.7.1, where the check_login function in login.php does not exit on failed authentication. This enables a remote attacker to bypass authentication and gain unauthorized access to VHCS application scripts. The co...

Virtual Hosting Control System 2.2/2.4 - 'change_password.php' Current Password

source: https://www.securityfocus.com/bid/16600/info Virtual Hosting Control System VHCS is prone to multiple input and access vulnerabilities. VHCS is prone to an HTML-injection vulnerability and an authentication-bypass vulnerability. These issues could be exploited to gain administrative acces...

VHCSXSS.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT...

CVE-2005-3902

VHCS (Virtual Hosting Control System) versions 2.2.0 through 2.4.6.2 are affected by a cross-site scripting (XSS) vulnerability in gui/errordocs/index.php. Attackers can inject arbitrary script or HTML via query strings that are reflected in an error message. The advisory entries (NVD CVE-2005-39...

Virtual Hosting Control System 2.22.4 - Error Message Cross-Site Scripting

Virtual Hosting Control System 2.22.4 - Error Message Cross-Site Scripting source: https://www.securityfocus.com/bid/15538/info Virtual Hosting Control System is prone to cross-site scripting attacks. The vulnerability arises when error messages are rendered and could let an attacker inject hosti...

Virtual Hosting Control System 2.2/2.4 - Error Message Cross-Site Scripting

source: https://www.securityfocus.com/bid/15538/info Virtual Hosting Control System is prone to cross-site scripting attacks. The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser session of another user in the...

[Full-Disclosure] Kernelpanik Labs Digest 2005-1

Hi and happy new year. This is a email digest with security fails recently published by Kernelpanik Labs http://www.kernelpanik.org Apache suEXEC Bypass -------------------- Small document about how bypass isolating procedures, i.e. suEXEC, in Apache WebServer. English document:...

Debian DSA-392-1 : webfs - buffer overflows, file and directory exposure

Jens Steube reported two vulnerabilities in webfs, a lightweight HTTP server for static content. CAN-2003-0832 - When virtual hosting is enabled, a remote client could specify '..' as the hostname in a request, allowing retrieval of directory listings or files above the document root. CAN-2003-08...

thttpd/mini_httpd Virtual Hosting File Disclosure

Binary data 2124.prm...

thttpd/mini_httpd < 2.24 Virtual Hosting File Disclosure

Binary data 2125.prm...

SuSE-SA:2003:044: thttpd

The remote host is missing the patch for the advisory SuSE-SA:2003:044 thttpd. Two vulnerabilities were found in the 'tiny' web-server thttpd. The first bug is a buffer overflow that can be exploited remotely to overwrite the EBP register of the stack. Due to memory-alignment of the stack done by...

DSA-396 thttpd - missing input sanitizing, wrong calculation

Bulletin has no description...

CVE-2002-1562

Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. dot dot sequences in the Host: header...

CVE-2002-1562

Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. dot dot sequences in the Host: header...

CVE-2002-1562

The CVE-2002-1562 entry affects thttpd in virtual-hosting mode, where a remote attacker can read arbitrary files by injecting a path into the Host header (directory traversal). Related advisories (CAN-2002-1562 and CAN-2003-0899) describe an information leak and remote code execution via a crafte...

SurfinGate.txt

Hi! I've found two possibilities to bypass the Finjan SurfinGate URL filter - Tested with Finjan SurfinGate 6.0x on Windows NT 4.0 and 2000. 1. IP Tunnel Normally humans use domain- and hostnames instead of IP addresses. Most users will add entries like "www.computec.ch" in the URL list of Finjan...

Security problems with TWIG webmail system

Twig is a popular webmail system written in PHP, once called Muppet. Author: Christopher Heschong Homepage: http://twig.screwdriver.net Version: 2.5.1 latest Problem: The possibility of processing our own php file , can leed to arbitrary command execution on the server as the httpd user. Status:...

CVE-2000-1204

Vulnerability in the modvhostalias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root...

Apache Httpd < 1.3.14 : Mass virtual hosting can display CGI source

A security problem for users of the mass virtual hosting module, modvhostalias, causes the source to a CGI to be sent if the cgi-bin directory is under the document root. However, it is not normal to have your cgi-bin directory under a document root...