UBUNTU-CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

CVE-2020-29600

In AWStats up to version 7.8, the CGI script cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc) instead of only reading /etc/awstats/awstats.conf, enabling path traversal. This issue is noted as arising from an incomplete fix for CVE-2017-1000501 and CVE-20...

CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

Eldy Awstats Path Traversal Vulnerability

Eldy Awstats is Eldy personal developer of a log analysis tool applied to Web sites. The software supports analyzing Web, WAP, proxy, streaming server, FTP, mail server log files on all operating systems such as IIS 5.0 +, Apache, etc. It displays all Web statistics including: visitors, pages,...

VulnCheck KEV: CVE-2005-0116

AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl...

VulnCheck KEV: CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

VulnCheck KEV: CVE-2006-2237

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter...

GLSA-202007-37 : AWStats: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202007-37 AWStats: Multiple vulnerabilities Multiple vulnerabilities have been discovered in AWStats. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for detail...

AWStats: Multiple vulnerabilities

Background AWStats is an advanced log file analyzer and statistics generator. Description Multiple vulnerabilities have been discovered in AWStats. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is ...

Remote Code Execution

awstats is vulnerable to arbitrary code execution. The vulnerability exists as a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution...

CVE-2008-5080

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting XSS attacks via the querystring parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

Command injection

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

CVE-2018-20912

Summary: CVE-2018-20912 affects cPanel before 70.0.23, where demo accounts could cause code execution via awstats (SEC-362). The issue is reported across multiple sources (e.g., Red Hat and CNVD entries) with the consistent description that vulnerable versions prior to 70.0.23 permit arbitrary co...

AWStats Information Disclosure Vulnerability

AWStats is a set of open source Web-based Web site traffic analysis software. The software is able to generate visual Web, streaming media , FTP or server statistics and so on. A security vulnerability exists in AWStats 7.6 and earlier versions. A remote attacker could exploit the vulnerability t...