hosting_controller 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk sql injection、パス処理の欠陥, and vendor risk input validation に関連することが多く、vendor surface software deployment and vendor surface production workloads の文脈で vendor impact data exposure and vendor impact unexpected behavior などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2005-3038 | Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability." | [email protected] | 5.0 | 1.37% | 2005-09-22 | 2026-06-16 |
| CVE-2005-2219 | Hosting Controller 6.1 Hotfix 2.1 allows remote authenticated users to perform unauthorized actions, such as modifying the credit limit, via a direct request to AccountActions.asp and modifying the CreditLimit parameter in an UpdateCreditLimit action. | [email protected] | 4.6 | 1.92% | 2005-07-12 | 2026-06-16 |
| CVE-2005-2077 | Cross-site scripting (XSS) vulnerability in error.asp for Hosting Controller allows remote attackers to inject arbitrary web script or HTML via the error parameter. | [email protected] | 4.3 | 3.61% | 2005-06-29 | 2026-06-16 |
| CVE-2005-1788 | SQL injection vulnerability in resellerresources.asp in Hosting Controller 6.1 Hotfix 2.0 allows remote attackers to execute arbitrary SQL commands via the jresourceid parameter. | [email protected] | 7.5 | 2.08% | 2005-06-01 | 2026-06-16 |
| CVE-2005-1784 | Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp. | [email protected] | 7.5 | 5.63% | 2005-05-27 | 2026-06-16 |
| CVE-2005-0695 | The password recovery feature (forgotpassword.asp) in Hosting Controller 6.1 Hotfix 1.7 and earlier allows remote attackers to determine the owner's e-mail address by providing a portion of the domain name to the "login ID" field. | [email protected] | 5.0 | 1.37% | 2005-03-07 | 2026-06-16 |
| CVE-2005-0694 | Hosting Controller 6.1 Hotfix 1.7 and earlier stores log files under the web root, which allows remote attackers to obtain sensitive information via a direct request to HCDiskQuotaService.csv. | [email protected] | 5.0 | 1.55% | 2005-03-07 | 2026-06-16 |
| CVE-2004-1217 | Hosting Controller 6.1 Hotfix 1.4, and possibly other versions, allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter to (1) Statsbrowse.asp or (2) Generalbrowse.asp. | [email protected] | 5.0 | 2.91% | 2005-01-10 | 2026-06-16 |
| CVE-2002-0776 | getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter, as addressed by the "UpdateUser" hot fix. | [email protected] | 7.5 | 1.79% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0775 | browse.asp in Hosting Controller allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter. | [email protected] | 5.0 | 8.26% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0774 | Hosting Controller creates a default user AdvWebadmin with a default password, which could allow remote attackers to gain privileges if the password is not changed. | [email protected] | 10.0 | 2.72% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0773 | imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as (1) ftp, (2) owwwPath, and (3) oftpPath. | [email protected] | 10.0 | 4.49% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0772 | Directory traversal vulnerability in dsnmanager.asp for Hosting Controller allows remote attackers to read arbitrary files and directories via a .. (dot dot) in the RootName parameter. | [email protected] | 6.4 | 9.24% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0466 | Hosting Controller 1.4.1 and earlier allows remote attackers to browse arbitrary directories via a full C: style pathname in the filepath arguments to (1) Statsbrowse.asp, (2) servubrowse.asp, (3) browsedisk.asp, (4) browsewebalizerexe.asp, or (5) sqlbrowse.asp. | [email protected] | 5.0 | 2.00% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0465 | Directory traversal vulnerability in filemanager.asp for Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files, and execute commands, via a .. (dot dot) in the OpenPath parameter. | [email protected] | 10.0 | 3.97% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0464 | Directory traversal vulnerability in Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files and directories via a .. (dot dot) in arguments to (1) file_editor.asp, (2) folderactions.asp, or (3) editoractions.asp. | [email protected] | 6.4 | 2.31% | 2002-08-12 | 2026-06-16 |
| CVE-2002-0212 | The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack. | [email protected] | 7.5 | 1.59% | 2002-05-16 | 2026-06-16 |