CVE-2008-3922: Improper Control of Generation of Code

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3921: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameter...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

AWStats Totals awstatstotals.php multisort() Function sort Parameter Arbitrary PHP Code Execution

The remote web server is running a version of awstatstotals.php which does not properly sanitize its 'sort' argument. An attacker can run arbitrary commands on the remote host within the context of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

AWStats Totals 'sort'参数远程命令执行漏洞

BUGTRAQ ID:30856 CNCAN ID：CNCAN-2008082701 Telartis's AWStats Totals是一款基于PHP的脚本程序。 Telartis's AWStats Totals不正确处理URL参数，远程攻击者可以利用漏洞以应用程序权限执行任意代码。 问题是脚本对提交给'sort'参数的数据缺少过滤，提交特殊的字符可插入PHP表达式，以WEB权限执行。 Telartis AWStats Totals 1.14 升级到AWStats Totals 1.15： http://www.telartis.nl/xcms/awstats/...

EMORY-2008-01.txt

Emory University UTS Security Advisory EMORY-2008-01 Topic: Multiple Vulnerabilities in AWStats Totals Original release date: August 26, 2008 SUMMARY ======= Telartis's AWStats Totals program is vulnerable to command execution and cross site scripting attacks. A remote attacker could exploit thes...

Multiple Vulnerabilities in AWStats Totals

Emory University UTS Security Advisory EMORY-2008-01 Topic: Multiple Vulnerabilities in AWStats Totals Original release date: August 26, 2008 SUMMARY ======= Telartis's AWStats Totals program is vulnerable to command execution and cross site scripting attacks. A remote attacker could exploit thes...

AWStats Totals multisort Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable. Module Options msf use exploit/unix/webapp/awstatstotals/multisort msf undefinedmultisort show actions ...actions... msf undefinedmultisort set...

CVE-2008-3714

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

CVE-2008-3714

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

Cross site scripting

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

CVE-2008-3714

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

DEBIAN-CVE-2008-3714

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

CVE-2008-3714

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

CVE-2008-3714

CVE-2008-3714 affects AWStats, specifically the CGI script awstats.pl in version 6.8, where user-controlled input in the query_string is not properly sanitized, enabling a cross-site scripting (XSS) vulnerability. The initial description explicitly states an XSS issue via the query_string, distin...

CVE-2008-3714: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945...

AWStats 6.8 - 'AWStats.pl' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30730/info AWStats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

AWStats 6.8 - AWStats.pl Cross-Site Scripting

AWStats 6.8 - AWStats.pl Cross-Site Scripting source: https://www.securityfocus.com/bid/30730/info AWStats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code ...

awstats -- multiple XSS vulnerabilities

Secunia reports: Morgan Todd has discovered a vulnerability in AWStats, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed in the URL to awstats.pl is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary...

Debian Security Advisory DSA 1058-1 (awstats)

The remote host is missing an update to awstats announced via advisory DSA 1058-1. Hendrik Weimer discovered that specially crafted web requests can cause awstats, a powerful and featureful web server log analyzer, to execute arbitrary commands. The old stable distribution woody is not affected b...