CVE-2019-12323

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hyp3rlinx.altervista.orgExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jun/28Exploit, Mailing List, Third Party Advisory
https://help.hostingcontroller.com/OnlineHelp/default.aspx?pageid=hc_release_notesRelease Notes, Vendor Advisory
http://hyp3rlinx.altervista.orgExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jun/28Exploit, Mailing List, Third Party Advisory
https://help.hostingcontroller.com/OnlineHelp/default.aspx?pageid=hc_release_notesRelease Notes, Vendor Advisory

Timeline

Published: Jun 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-123247.2A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on th CVE-2019-123258.8The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, whic CVE-2019-123269.8Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a man CVE-2019-123279.8Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service CVE-2019-123288.8A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP p CVE-2019-12337.5A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory,CVE-2019-123318.8PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than CVE-2019-12347.5A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.CVE-2019-123456.1XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.CVE-2019-123466.1In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially cr CVE-2019-123476.1In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accoun CVE-2019-123489.8An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.