Filtered by vendor Centos-webpanel
Subscribe
Search
Total
28 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-13383 | 1 Centos-webpanel | 1 Centos Web Panel | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response. | |||||
| CVE-2019-13385 | 1 Centos-webpanel | 1 Centos Web Panel | 2021-07-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log. | |||||
| CVE-2019-13599 | 1 Centos-webpanel | 1 Centos Web Panel | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times. | |||||
| CVE-2019-14722 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account. | |||||
| CVE-2019-14245 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 5.5 MEDIUM | 6.5 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account. | |||||
| CVE-2019-14246 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account. | |||||
| CVE-2019-14723 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account. | |||||
| CVE-2019-14726 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 6.5 MEDIUM | 5.4 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account. | |||||
| CVE-2019-14727 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account. | |||||
| CVE-2019-14728 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account. | |||||
| CVE-2019-14729 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 5.5 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account. | |||||
| CVE-2019-14730 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account. | |||||
| CVE-2019-14782 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account. | |||||
| CVE-2019-15235 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782. | |||||
| CVE-2019-16295 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-11-05 | 1.9 LOW | 4.6 MEDIUM |
| Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim. | |||||
| CVE-2019-14725 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-09-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account. | |||||
| CVE-2019-14721 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-09-12 | 5.5 MEDIUM | 6.5 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account. | |||||
| CVE-2019-13476 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-08-27 | 3.5 LOW | 5.4 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page. | |||||
| CVE-2019-13387 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-08-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website. | |||||
| CVE-2019-12190 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-05-21 | 3.5 LOW | 5.4 MEDIUM |
| XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter. | |||||
| CVE-2019-11429 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-05-15 | 3.5 LOW | 4.8 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen. | |||||
| CVE-2019-10261 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-05-06 | 3.5 LOW | 4.8 MEDIUM |
| CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action. | |||||
| CVE-2019-10893 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-05-02 | 3.5 LOW | 4.8 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute. | |||||
| CVE-2019-7646 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-03-27 | 3.5 LOW | 4.8 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter. | |||||
| CVE-2018-18324 | 1 Centos-webpanel | 1 Centos Web Panel | 2018-12-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter. | |||||
| CVE-2018-18774 | 1 Centos-webpanel | 1 Centos Web Panel | 2018-11-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter. | |||||
| CVE-2018-5962 | 1 Centos-webpanel | 1 Centos Web Panel | 2018-02-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module. | |||||
| CVE-2018-5961 | 1 Centos-webpanel | 1 Centos Web Panel | 2018-02-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file. | |||||