CVE-2020-15611

CVE-2020-15611 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_dashboard.php: when parsing the service_restart parameter, the code does not properly validate a user-supplied string before using it in a system call, enabling remote code execution with root privileges. Multiple so...

CVE-2020-15610

CVE-2020-15610 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in the file ajax_php_pecl.php where parsing the modulo parameter allows an attacker to execute arbitrary code with root privileges, without authentication. Multiple sources (ZDI-20-757, Red Hat, CNVD/CVE records) co...

CVE-2020-15609

CVE-2020-15609 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_dashboard.php when parsing the service_stop parameter, where unvalidated input can be used to execute a system call, allowing remote code execution as root. The issue is documented across multiple feeds (including ZD...

CVE-2020-15608

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the aiservice parameter, the process...

CVE-2020-15609

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the servicestop parameter, the proces...

CVE-2020-15606

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. The issue results from the lack of proper validati...

CVE-2020-15607

CVE-2020-15607 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_admin_apis.php when parsing the line parameter, where insufficient validation allows an attacker to use the string to execute a system call, potentially yielding code execution in the root context. Multiple sources c...

CVE-2020-15606

CVE-2020-15606 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a remote code execution flaw in ajax_admin_apis.php caused by insufficient validation of a user-supplied string used to call a system command, allowing an unauthenticated attacker to execute code as root. Public dis...

CVE-2020-15435

The CVE-2020-15435 issue affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_dashboard.php where parsing the service_start parameter allows an attacker to construct a system call, enabling remote code execution with root privileges. It is exploitable remotely without authen...

CVE-2020-15433

CVE-2020-15433 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the phpversion parameter, which allows an unauthenticated attacker to execute arbitrary code with root privileges via a remote code execution vector. Multiple sources (including ZDI-20-750) ...

CVE-2020-15434

CVE-2020-15434 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerable component is ajax_php_pecl.php where the canal parameter is not properly validated before using it to execute a system call, enabling remote code execution with root privileges. Exploitation is possible without authentica...

CVE-2020-15433

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxphppecl.php. When parsing the phpversion parameter, the process...

CVE-2020-15432

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the filespace parameter, the...

CVE-2020-15432

The CVE-2020-15432 entry affects CentOS Web Panel (CWP) software, specifically cwp-e17.0.9.8.923. The underlying issue is in ajax_migration_cpanel.php where the filespace parameter is not properly validated before use in a system call, enabling remote code execution with root privileges and no au...

CVE-2020-15431

CVE-2020-15431 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php where parsing the user parameter allows executing a system call with root privileges, enabling remote code execution without authentication. Multiple sources (including ZDI-20-748) document this as a remote...

CVE-2020-15429

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxcrons.php. When parsing the user parameter, the process does not...

CVE-2020-15430

This CVE (CVE-2020-15430) affects CentOS Web Panel, version cwp-e17.0.9.8.923. The vulnerability resides in ajax_list_accounts.php; the code path parsing the username parameter does not properly validate input before using it to execute a system call, allowing remote attackers to execute arbitrar...

CVE-2020-15429

CVE-2020-15429 affects CentOS Web Panel (cwp-e17.0.9.8.923). A flaw in ajax_crons.php allows remote command injection: when parsing the user parameter, the code does not properly validate the string before using it in a system call, enabling arbitrary code execution with root privileges. Authenti...

CVE-2020-15427

The CVE-2020-15427 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) where the ajax_disk_usage.php file parses the folderName parameter but does not validate it before using it in a system call, allowing remote code execution with root privileges. Public disclosures (ZDI-20-744 and related advis...

CVE-2020-15428

CVE-2020-15428 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php: when parsing the line parameter, user-supplied input is used to perform a system call without proper validation, allowing remote attackers to execute code with root privileges. Exploitation is unauthentica...