EUVD-2005-0364

Malware in sbrugna...

EUVD-2010-4337

Malware in sbrugna...

EUVD-2008-3700

Malware in sbrugna...

EUVD-2020-21961

Malware in sbrugna...

EUVD-2018-2319

Malware in sbrugna...

EUVD-2017-1610

Malware in sbrugna...

EUVD-2006-3677

Malware in sbrugna...

EUVD-2005-0363

Malware in sbrugna...

EUVD-2005-0436

Malware in sbrugna...

CVE-2010-4368

awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname...

SUSE CVE-2005-0363

awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter...

SUSE CVE-2006-3682

awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the 1 year, 2 pluginmode or 3 month parameters...

USN-4953-1 awstats vulnerabilities

Sean Boran discovered that AWStats incorrectly filtered certain parameters. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2020-29600 It was discovered that AWStats incorrectly filtered certain parameters. A remote attacker could possibly use this issue to access...

[ASA-202103-15] awstats: directory traversal

Arch Linux Security Advisory ASA-202103-15 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-35176 Package : awstats Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1356 Summary ======= The package awstats before versio...

ALPINE-CVE-2020-35176

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600...

DEBIAN-CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

Remote Code Execution

awstats is vulnerable to arbitrary code execution. The vulnerability exists as a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

UBUNTU-CVE-2018-10245

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters...

Ubuntu 14.04 LTS / 16.04 LTS : AWStats vulnerability (USN-3518-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3518-1 advisory. It was discovered that AWStats incorrectly filtered certain parameters. A remote attacker could possibly use this issue to execute arbitrary code...