CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 3CVE-2019-11193 – DirectAdmin 1.561 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-11193
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel. El FileManager en InfinitumIT DirectAdmin a través de la versión 1.561 presenta XSS de CMD_FILE_MANAGER, CMD_SHOW_USER y CMD_SHOW_RESELLER; un atacante puede omitir la protección CSRF con esto, y tomar el control del panel de administración. DirectAdmin versions 1.561 and below suffer from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/46694 http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html https://numanozdemir.com/respdisc/directadmin.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5305
https://notcve.org/view.php?id=CVE-2012-5305
Cross-site scripting (XSS) vulnerability in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allows remote attackers to inject arbitrary web script or HTML via the domain parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en CMD_DOMAIN en JBMC Software DirectAdmin v1.403 permite a atacantes remotos a inyectar secuencias de comandos Web o HTML a través del parámetro domain. • http://archives.neohapsis.com/archives/bugtraq/2012-04/0034.html http://www.securityfocus.com/bid/52848 http://www.vulnerability-lab.com/get_content.php?id=486 https://exchange.xforce.ibmcloud.com/vulnerabilities/74569 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2012-3842
https://notcve.org/view.php?id=CVE-2012-3842
Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en CMD_DOMAIN en JBMC Software DirectAdmin v1.403, permite a usuarios con ciertos privilegios autenticados remotamente, inyectar secuencias de comandos web o HTML a través de los parámetros (1) select0 o (2) select8. • http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html http://www.securityfocus.com/bid/53281 http://www.vulnerability-lab.com/get_content.php?id=509 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.9EPSS: 0%CPEs: 115EXPL: 1CVE-2009-1526 – DirectAdmin 1.33.3 - '/CMD_DB' Backup Action Insecure Temporary File Creation
https://notcve.org/view.php?id=CVE-2009-1526
JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATH_INFO to the CMD_DB script during a backup action. JBMC Software DirectAdmin anterior a v1.334 permite a usuarios locales crear o sobreescribir cualquier fichero a través de un ataque de enlace simbólico en un directorio temporal concreto, relacionada con una petición para ese fichero temporal en PATH_INFO en la secuencia de comandos CMD_DB durante una acción de copia de seguridad. • https://www.exploit-db.com/exploits/32947 http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0228.html http://osvdb.org/54014 http://secunia.com/advisories/34861 http://www.directadmin.com/features.php?id=968 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.5EPSS: 0%CPEs: 115EXPL: 1CVE-2009-1525
https://notcve.org/view.php?id=CVE-2009-1525
CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action. CMD_DB en JBMC Software DirectAdmin anterior a v1.334 permite a usuarios remotos autenticados conseguir privilegios a través de metacaracteres del interprete de comandos en el parámetro "name" durante una acción "restore". • http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0228.html http://osvdb.org/54015 http://secunia.com/advisories/34861 http://www.directadmin.com/features.php?id=968 https://exchange.xforce.ibmcloud.com/vulnerabilities/50167 • CWE-20: Improper Input Validation •