1174 matches found
CVE-2020-15614
CVE-2020-15614 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the cha parameter, where input is not properly validated before a system call, allowing an unauthenticated attacker to execute arbitrary code with root privileges. This has been disclosed in...
CVE-2020-15615
The CVE-2020-15615 entry affects CentOS Web Panel (CWP) version cwp-e17.0.9.8.923. The flaw is in ajax_ftp_manager.php, where a user-supplied string is used to construct a system call without proper validation, allowing unauthenticated remote code execution with root privileges. Public references...
CVE-2020-15615
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. The issue results from the lack of proper...
CVE-2020-15613
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. When parsing the line parameter, the process does...
CVE-2020-15612
CVE-2020-15612 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_ftp_manager.php where parsing the userLogin parameter allows an attacker to execute arbitrary code with root privileges via a remote attack, without authentication. This is documented across multiple sources, includi...
CVE-2020-15613
CVE-2020-15613 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_admin_apis.php when parsing the line parameter, where unsanitized input is used to execute a system call, enabling remote code execution with root privileges and no authentication. Public advisories reference ZDI-20-...
CVE-2020-15611
CVE-2020-15611 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_dashboard.php: when parsing the service_restart parameter, the code does not properly validate a user-supplied string before using it in a system call, enabling remote code execution with root privileges. Multiple so...
CVE-2020-15610
CVE-2020-15610 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in the file ajax_php_pecl.php where parsing the modulo parameter allows an attacker to execute arbitrary code with root privileges, without authentication. Multiple sources (ZDI-20-757, Red Hat, CNVD/CVE records) co...
CVE-2020-15611
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the servicerestart parameter, the...
CVE-2020-15608
CVE-2020-15608 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_dashboard.php when parsing the ai_service parameter, where unvalidated user input is used to execute a system call, enabling remote code execution with root privileges and no authentication. Public disclosur...
CVE-2020-15609
CVE-2020-15609 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_dashboard.php when parsing the service_stop parameter, where unvalidated input can be used to execute a system call, allowing remote code execution as root. The issue is documented across multiple feeds (including ZD...
CVE-2020-15609
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the servicestop parameter, the proces...
CVE-2020-15608
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the aiservice parameter, the process...
CVE-2020-15607
CVE-2020-15607 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_admin_apis.php when parsing the line parameter, where insufficient validation allows an attacker to use the string to execute a system call, potentially yielding code execution in the root context. Multiple sources c...
CVE-2020-15607
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. When parsing the line parameter, the process does...
CVE-2020-15606
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. The issue results from the lack of proper validati...
CVE-2020-15606
CVE-2020-15606 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a remote code execution flaw in ajax_admin_apis.php caused by insufficient validation of a user-supplied string used to call a system command, allowing an unauthenticated attacker to execute code as root. Public dis...
CVE-2020-15435
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the servicestart parameter, the proce...
CVE-2020-15434
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxphppecl.php. When parsing the canal parameter, the process does n...
CVE-2020-15435
The CVE-2020-15435 issue affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_dashboard.php where parsing the service_start parameter allows an attacker to construct a system call, enabling remote code execution with root privileges. It is exploitable remotely without authen...