Blog
This release fixes several security issues in ISPConfig: Authenticated XSS issue in multiple email forms. Authenticated reflected XSS issue in DNS zone import tool. Validation failure in the language file import tool. …
This release fixes several security issues in ISPConfig 3.3.0: An authenticated code injection in language_edit functionality was found by SSD-Disclosure. This requires a valid administrator login. Administrators could …
This release fixes several bugs in ISPConfig. The most critical problem is a stored XSS issue in the data log history detail page. Exploiting the XSS issue requires a valid login as admin user. Thank you to Daniel …
This release is an important security release that fixes an issue in the ISPConfig Remote API . Please update as soon as possible if you are actively using the Remote API in ISPConfig! Special thanks to Sam Pizzey for …
This release is an important security release that fixes a SQL injection issue. Please update as soon as possible! If you are not able to update, please use the ISPConfig patch tool to fix the security issue. Special …
An SQL injection vulnerability has been discovered in ISPConfig. This release fixes that issue. Thanks to Paolo Serracino for finding and reporting this issue! Who is affected by this issue? Most likely your system is …
The ISPConfig source code has undergone an initial code review by security company RACK911 LABS. During this check several problems were found which were fixed in this patch version. This release improves the protection …
A security vulnerability has been found in ISPConfig which might allow a client to create folders outside of his web root and to alter permissions of folders outside of the web root. The following two requirements must …
A security vulnerability has been found in ISPConfig which might allow a client to execute code under the permissions of the ispconfig user. The following two requirements must be met for this: - The attacker must have …
This update fixes several XSS vulnerabilities that were found in ISPConfig. A valid ISPConfig login is required to exploit the XSS vulnerabilities. The release includes other bugfixes and some minor improvements as …
This release contains an important security fix for an authenticated local root vulnerability in the ISPConfig website cron system, the vulnerability has the CVE number CVE-2017-17384 assigned and has been reported to …
What's new in ISPConfig 3.0.5.4p7 This release contains a security fix against a SQL injection attack and a new protection against CSRF attacks. A problem that the public keys of website ssh users were not saved into …
What's new in ISPConfig 3.0.5.4p6 This release contains 2 important security fixes, solves a problem in the APS installer and adds support for Debian 8 and Ubuntu 15.04. It is highly recommended to install this patch …
A XSS vulnerability has been found in the ISPConfig 3 module changer script. The vulnerability requires a valid user login to ISPConfig, unauthenticated users are not affected. Vulnerable versions: All recent ISPConfig …
ISPConfig 3.0.5.4 Patch 3 is available for download. This is a patch release for ISPConfig 3.0.5.4 that fixes some issues that were found in the last version and adds several security enhancements. See changelog link …
