Filtered by vendor Vestacp
Subscribe
Total
22 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-9841 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL. | |||||
| CVE-2019-12792 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
| A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root. | |||||
| CVE-2019-12791 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
| A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form. | |||||
| CVE-2018-18547 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI. | |||||
| CVE-2018-10686 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php. | |||||
| CVE-2018-1000884 | 1 Vestacp | 1 Vesta Control Panel | 2024-11-21 | 5.0 MEDIUM | 9.8 CRITICAL |
| Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password reset codes, attacker is able to change administrator password. This attack appear to be exploitable via Unauthenticated network connectivity. This vulnerability appears to have been fixed in After commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- release version 0.9.8-19. | |||||
| CVE-2015-4117 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php. | |||||
| CVE-2015-2861 | 1 Vestacp | 1 Vesta Control Panel | 2024-11-21 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users. | |||||
| CVE-2022-36303 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | N/A | 6.1 MEDIUM |
| Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php. | |||||
| CVE-2021-46850 | 1 Vestacp | 2 Control Panel, Vesta Control Panel | 2024-02-04 | N/A | 7.2 HIGH |
| myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint. | |||||
| CVE-2022-36304 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | N/A | 6.1 MEDIUM |
| Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php. | |||||
| CVE-2022-36305 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | N/A | 6.1 MEDIUM |
| Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php. | |||||
| CVE-2022-34025 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | N/A | 6.1 MEDIUM |
| Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php. | |||||
| CVE-2021-43693 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php. | |||||
| CVE-2021-30462 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | 9.0 HIGH | 7.2 HIGH |
| VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts. | |||||
| CVE-2021-30463 | 1 Vestacp | 1 Control Panel | 2024-02-04 | 7.2 HIGH | 7.8 HIGH |
| VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely. | |||||
| CVE-2021-28379 | 2 Myvestacp, Vestacp | 2 Myvesta, Vesta Control Panel | 2024-02-04 | 6.8 MEDIUM | 8.8 HIGH |
| web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin. | |||||
| CVE-2020-10966 | 2 Hestiacp, Vestacp | 2 Control Panel, Control Panel | 2024-02-04 | 4.3 MEDIUM | 6.5 MEDIUM |
| In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name. | |||||
| CVE-2020-10808 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | 9.0 HIGH | 8.8 HIGH |
| Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters. | |||||
| CVE-2020-10786 | 1 Vestacp | 1 Vesta Control Panel | 2024-02-04 | 9.0 HIGH | 8.8 HIGH |
| A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs. | |||||