12870 matches found
CVE-2020-15621
CVE-2020-15621 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the email parameter is used to construct SQL queries without proper validation, allowing remote attackers to disclose sensitive information in the context of root. Multiple sources (ZDI-20-76...
CVE-2020-15622
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the search parameter, the...
CVE-2020-15620
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the id parameter, the...
CVE-2020-15619
CentOS Web Panel (cwp-e17.0.9.8.923) is affected by a SQL injection in ajax_list_accounts.php when parsing the type parameter. The vulnerability allows remote attackers, with no authentication, to disclose sensitive information in the root context by constructing SQL queries from unvalidated user...
CVE-2020-15620
The CVE-2020-15620 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php where the id parameter is used to build queries without proper validation, enabling information disclosure in the context of root. This is documented across multiple sources (ZDI...
CVE-2020-15619
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the type parameter, the...
CVE-2020-15616
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the package parameter, the...
CVE-2020-15618
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the username parameter, th...
CVE-2020-15617
CVE-2020-15617 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a SQL injection in ajax_list_accounts.php where the status parameter is not properly validated before being used in queries, enabling remote disclosure of sensitive information with no authentication. This is docume...
CVE-2020-15616
CVE-2020-15616 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw resides in ajax_list_accounts.php where parsing of the package parameter enables unauthenticated remote SQL information disclosure in the context of root due to inadequate input validation when building queries. Multiple source...
CVE-2020-15617
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the status parameter, the...
CVE-2020-15618
The CVE-2020-15618 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php triggered by the username parameter. It allows remote, unauthenticated attackers to disclose sensitive information in the root context. The vulnerability is documented by ZDI (ZD...
CVE-2020-15614
CVE-2020-15614 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the cha parameter, where input is not properly validated before a system call, allowing an unauthenticated attacker to execute arbitrary code with root privileges. This has been disclosed in...
CVE-2020-15615
The CVE-2020-15615 entry affects CentOS Web Panel (CWP) version cwp-e17.0.9.8.923. The flaw is in ajax_ftp_manager.php, where a user-supplied string is used to construct a system call without proper validation, allowing unauthenticated remote code execution with root privileges. Public references...
CVE-2020-15614
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxphppecl.php. When parsing the cha parameter, the process does not...
CVE-2020-15615
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. The issue results from the lack of proper...
CVE-2020-15613
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. When parsing the line parameter, the process does...
CVE-2020-15612
CVE-2020-15612 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_ftp_manager.php where parsing the userLogin parameter allows an attacker to execute arbitrary code with root privileges via a remote attack, without authentication. This is documented across multiple sources, includi...
CVE-2020-15613
CVE-2020-15613 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_admin_apis.php when parsing the line parameter, where unsanitized input is used to execute a system call, enabling remote code execution with root privileges and no authentication. Public advisories reference ZDI-20-...
CVE-2020-15611
CVE-2020-15611 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_dashboard.php: when parsing the service_restart parameter, the code does not properly validate a user-supplied string before using it in a system call, enabling remote code execution with root privileges. Multiple so...