5 results (0.010 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 3

12 Apr 2019 — The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel. El FileManager en InfinitumIT DirectAdmin a través de la versión 1.561 presenta XSS de CMD_FILE_MANAGER, CMD_SHOW_USER y CMD_SHOW_RESELLER; un atacante puede omitir la protección CSRF con esto, y tomar el control del panel de administración. DirectAdmin versions 1.561 and below suffer from m... • https://www.exploit-db.com/exploits/46694 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 3

25 Jun 2009 — Cross-site scripting (XSS) vulnerability in CMD_REDIRECT in DirectAdmin 1.33.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the URI in a view=advanced request. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en CMD_REDIRECT en DirectAdmin v1.33.6 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante la URI en una petición view=advanced. • https://www.exploit-db.com/exploits/33048 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 115EXPL: 1

05 May 2009 — CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action. CMD_DB en JBMC Software DirectAdmin anterior a v1.334 permite a usuarios remotos autenticados conseguir privilegios a través de metacaracteres del interprete de comandos en el parámetro "name" durante una acción "restore". • http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0228.html • CWE-20: Improper Input Validation •

CVSS: 6.9EPSS: 0%CPEs: 115EXPL: 1

05 May 2009 — JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATH_INFO to the CMD_DB script during a backup action. JBMC Software DirectAdmin anterior a v1.334 permite a usuarios locales crear o sobreescribir cualquier fichero a través de un ataque de enlace simbólico en un directorio temporal concreto, relacionada con una petición para ese fichero temp... • https://www.exploit-db.com/exploits/32947 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •

CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1

10 Apr 2007 — Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script that invokes /usr/bin/logger; (4) allows local users to inject arbitrary web script or HTML into /var/log/messages by... • http://secunia.com/advisories/24728 •