CVE-2020-15434

CVE-2020-15434 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerable component is ajax_php_pecl.php where the canal parameter is not properly validated before using it to execute a system call, enabling remote code execution with root privileges. Exploitation is possible without authentica...

CVE-2020-15433

CVE-2020-15433 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the phpversion parameter, which allows an unauthenticated attacker to execute arbitrary code with root privileges via a remote code execution vector. Multiple sources (including ZDI-20-750) ...

CVE-2020-15433

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxphppecl.php. When parsing the phpversion parameter, the process...

CVE-2020-15431

CVE-2020-15431 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php where parsing the user parameter allows executing a system call with root privileges, enabling remote code execution without authentication. Multiple sources (including ZDI-20-748) document this as a remote...

CVE-2020-15431

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxcrons.php. When parsing the user parameter, the process does not...

CVE-2020-15432

The CVE-2020-15432 entry affects CentOS Web Panel (CWP) software, specifically cwp-e17.0.9.8.923. The underlying issue is in ajax_migration_cpanel.php where the filespace parameter is not properly validated before use in a system call, enabling remote code execution with root privileges and no au...

CVE-2020-15432

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the filespace parameter, the...

CVE-2020-15429

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxcrons.php. When parsing the user parameter, the process does not...

CVE-2020-15430

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the username parameter, the proces...

CVE-2020-15430

This CVE (CVE-2020-15430) affects CentOS Web Panel, version cwp-e17.0.9.8.923. The vulnerability resides in ajax_list_accounts.php; the code path parsing the username parameter does not properly validate input before using it to execute a system call, allowing remote attackers to execute arbitrar...

CVE-2020-15429

CVE-2020-15429 affects CentOS Web Panel (cwp-e17.0.9.8.923). A flaw in ajax_crons.php allows remote command injection: when parsing the user parameter, the code does not properly validate the string before using it in a system call, enabling arbitrary code execution with root privileges. Authenti...

CVE-2020-15427

The CVE-2020-15427 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) where the ajax_disk_usage.php file parses the folderName parameter but does not validate it before using it in a system call, allowing remote code execution with root privileges. Public disclosures (ZDI-20-744 and related advis...

CVE-2020-15428

CVE-2020-15428 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php: when parsing the line parameter, user-supplied input is used to perform a system call without proper validation, allowing remote attackers to execute code with root privileges. Exploitation is unauthentica...

CVE-2020-15427

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdiskusage.php. When parsing the folderName parameter, the process...

CVE-2020-15428

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxcrons.php. When parsing the line parameter, the process does not...

CVE-2020-15425

CVE-2020-15425 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in ajax_mod_security.php and stems from improper validation of a user-supplied string used to perform a system call, enabling remote code execution with root privileges. Exploitation does not require authentica...

CVE-2020-15426

The CVE-2020-15426 issue affects CentOS Web Panel (CWP) on version cwp-e17.0.9.8.923. The root cause is a failure to validate the user-supplied serverip string in ajax_migration_cpanel.php before using it in a system call, enabling remote code execution with root privileges. Access does not requi...

CVE-2020-15424

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the domain parameter, the process...

CVE-2020-15426

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the serverip parameter, the...

CVE-2020-15424

This CVE (CVE-2020-15424) affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mod_security.php when parsing the domain parameter, where unvalidated user input is used to execute a system call, allowing remote code execution as root without authentication. Documented impact mirrors Z...