Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameter...

CVE-2008-3921

Multiple cross-site scripting XSS vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameter...

CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3921

Multiple cross-site scripting XSS vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameter...

CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3922

The awstatstotals.php script in AWStats Totals versions 1.0 through 1.14 is vulnerable to Remote Command Execution (RCE) . The root cause is the insufficient sanitization of the sort parameter, which is used by the multisort function to dynamically create an anonymous PHP function. A remote attac...

CVE-2008-3921

CVE-2008-3921 affects AWStats Totals 1.0–1.14. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the month and year parameters, allowing remote attackers to inject arbitrary web script or HTML. The connected documents provide the affected product/version and the input vectors...

awstats-exec.txt

\n"; arrayshift$argv; $host = $argv0; Start the interactive shell while1 fwriteSTDOUT, "shell: "...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. VID e86fbb5f-0d04-11da-bc08-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. VID 0f5a2b4d-694b-11d9-a9e7-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. VID fdad8a87-7f94-11d9-a9e7-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. VID 2df297a2-dc74-11da-a22b-000c6ec775d9 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

CVE-2008-3922: Improper Control of Generation of Code

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3921: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameter...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: awstats

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

AWStats Totals 'sort'参数远程命令执行漏洞

BUGTRAQ ID:30856 CNCAN ID：CNCAN-2008082701 Telartis's AWStats Totals是一款基于PHP的脚本程序。 Telartis's AWStats Totals不正确处理URL参数，远程攻击者可以利用漏洞以应用程序权限执行任意代码。 问题是脚本对提交给'sort'参数的数据缺少过滤，提交特殊的字符可插入PHP表达式，以WEB权限执行。 Telartis AWStats Totals 1.14 升级到AWStats Totals 1.15： http://www.telartis.nl/xcms/awstats/...

EMORY-2008-01.txt

Emory University UTS Security Advisory EMORY-2008-01 Topic: Multiple Vulnerabilities in AWStats Totals Original release date: August 26, 2008 SUMMARY ======= Telartis's AWStats Totals program is vulnerable to command execution and cross site scripting attacks. A remote attacker could exploit thes...