Vendor
hestiacp
20 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
High 7.2
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/,…
-
High 8.8
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can explo…
-
High 8.3
HestiaCP Admin Takeover
HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator use…
-
High 7.5
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the r…
-
High 8.8
Privilege Chaining in hestiacp/hestiacp
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
-
High 8.5
Code Injection in hestiacp/hestiacp
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.