CVE

Id
13138  
CVE No.
CVE-2005-1932  
Status
Candidate  
Description
Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and (1) modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, (2) close, open, or respond to arbitrary support tickets via the close, open, or pid parameter to view_ticket.php, (3) obtain sensitive information on arbitrary invoices via the inv parameter to viewreceipt.php, or (4) modify domain information for arbitrary domains via the editdomain parameter to domains.php.  
Phase
Assigned (20050609)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
94678 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable in that it allows an attacker to close any support ticket within the system.  View
94679 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034414.html  View
94680 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable in that it allows an attacker to open any support ticket within the system.  View
94681 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034415.html  View
94682 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable in that it allows an attacker to reset the DNS information of any domain name managed by the system.  View
94683 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034419.html  View
94684 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable to the unauthorized viewing of client invoice information.  View
94685 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034417.html  View
94686 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable to unauthorized domain management access.  View
94687 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034416.html  View
94688 13138 CVE-2005-1932 FULLDISC:20050606 Lpanel.NET"s Lpanel (all versions up to and including 1.59) is vulnerable in that it allows an attacker to respond to any support ticket on the system.  View
94689 13138 CVE-2005-1932 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034418.html  View
94690 13138 CVE-2005-1932 CONFIRM:http://www.lpanel.net/changelog.php  View
94691 13138 CVE-2005-1932 BID:13869  View
94692 13138 CVE-2005-1932 URL:http://www.securityfocus.com/bid/13869  View
94693 13138 CVE-2005-1932 SECUNIA:15589  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
62174 JVNDB-2005-000376 Gaim の符号付き整数の処理の不備によるサービス運用妨害 (DoS) の脆弱性 ------------ CVE-2005-1934 13138 5 http://jvndb.jvn.jp/ja/contents/2005/JVNDB-2005-000376.html  View