13505 matches found
CVE-2020-15628
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the user parameter, the...
CVE-2020-15628
CVE-2020-15628 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the parameter parsing for the user input is not properly validated before being used to build SQL queries, enabling a remote SQL injection in the root context. Authentication is not required....
CVE-2020-15625
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxaddmailbox.php. When parsing the username parameter, the...
CVE-2020-15625
CVE-2020-15625 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in the ajax_add_mailbox.php component, where the username parameter is used to construct SQL queries without proper validation, enabling an unauthenticated attacker to disclose sensitive information in the cont...
CVE-2020-15626
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the term parameter, the proce...
CVE-2020-15626
CVE-2020-15626 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is an SQL injection in ajax_dashboard.php when parsing the term parameter, allowing remote attackers to disclose sensitive information in the root context without authentication. Public references from ZDI-20-773 and r...
CVE-2020-15624
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxnewaccount.php. When parsing the domain parameter, the...
CVE-2020-15623
CVE-2020-15623 affects CentOS Web Panel (CWP) cwp-e17.0.9.8.923 where the ajax_mod_security.php component parses the archivo parameter without proper path validation, allowing remote attackers to write arbitrary files and potentially execute code as root. This is a network-based, unauthenticated ...
CVE-2020-15623
This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the archivo parameter, the process...
CVE-2020-15624
CVE-2020-15624 affects CentOS Web Panel (CWP) — version cwp-e17.0.9.8.923 — where the ajax_new_account.php component does not properly validate the domain parameter before constructing SQL queries, enabling an unauthenticated remote SQL injection that can disclose sensitive information in the con...
CVE-2020-15621
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the email parameter, the...
CVE-2020-15622
CVE-2020-15622 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where unvalidated user input in the search parameter is used to construct SQL queries, enabling an unauthenticated attacker to disclose sensitive information, in the context of root. Multiple trust...
CVE-2020-15621
CVE-2020-15621 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the email parameter is used to construct SQL queries without proper validation, allowing remote attackers to disclose sensitive information in the context of root. Multiple sources (ZDI-20-76...
CVE-2020-15622
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the search parameter, the...
CVE-2020-15619
CentOS Web Panel (cwp-e17.0.9.8.923) is affected by a SQL injection in ajax_list_accounts.php when parsing the type parameter. The vulnerability allows remote attackers, with no authentication, to disclose sensitive information in the root context by constructing SQL queries from unvalidated user...
CVE-2020-15620
The CVE-2020-15620 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php where the id parameter is used to build queries without proper validation, enabling information disclosure in the context of root. This is documented across multiple sources (ZDI...
CVE-2020-15620
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the id parameter, the...
CVE-2020-15619
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the type parameter, the...
CVE-2020-15616
CVE-2020-15616 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw resides in ajax_list_accounts.php where parsing of the package parameter enables unauthenticated remote SQL information disclosure in the context of root due to inadequate input validation when building queries. Multiple source...
CVE-2020-15616
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the package parameter, the...