CVE-2020-15429

CVE-2020-15429 affects CentOS Web Panel (cwp-e17.0.9.8.923). A flaw in ajax_crons.php allows remote command injection: when parsing the user parameter, the code does not properly validate the string before using it in a system call, enabling arbitrary code execution with root privileges. Authenti...

CVE-2020-15427

The CVE-2020-15427 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) where the ajax_disk_usage.php file parses the folderName parameter but does not validate it before using it in a system call, allowing remote code execution with root privileges. Public disclosures (ZDI-20-744 and related advis...

CVE-2020-15428

CVE-2020-15428 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php: when parsing the line parameter, user-supplied input is used to perform a system call without proper validation, allowing remote attackers to execute code with root privileges. Exploitation is unauthentica...

CVE-2020-15427

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdiskusage.php. When parsing the folderName parameter, the process...

CVE-2020-15428

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxcrons.php. When parsing the line parameter, the process does not...

CVE-2020-15425

CVE-2020-15425 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in ajax_mod_security.php and stems from improper validation of a user-supplied string used to perform a system call, enabling remote code execution with root privileges. Exploitation does not require authentica...

CVE-2020-15424

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the domain parameter, the process...

CVE-2020-15426

The CVE-2020-15426 issue affects CentOS Web Panel (CWP) on version cwp-e17.0.9.8.923. The root cause is a failure to validate the user-supplied serverip string in ajax_migration_cpanel.php before using it in a system call, enabling remote code execution with root privileges. Access does not requi...

CVE-2020-15425

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. The issue results from the lack of proper...

CVE-2020-15426

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the serverip parameter, the...

CVE-2020-15424

This CVE (CVE-2020-15424) affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mod_security.php when parsing the domain parameter, where unvalidated user input is used to execute a system call, allowing remote code execution as root without authentication. Documented impact mirrors Z...

CVE-2020-15423

CVE-2020-15423 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_mod_security.php where parsing the dominio parameter allows an attacker to bypass validation and execute a system call, yielding remote code execution with root privileges. Multiple connected sources corrobo...

CVE-2020-15423

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the dominio parameter, the process...

CVE-2020-15422

CVE-2020-15422 affects CentOS Web Panel cwp-e17.0.9.8.923. The issue is in ajax_mod_security.php where the archivo parameter is parsed without proper validation, allowing an attacker to execute arbitrary code with root privileges. This is a network-based remote code execution vulnerability (no au...

CVE-2020-15422

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the archivo parameter, the process...

CVE-2020-15421

CVE-2020-15421 affects CentOS Web Panel (cwp-e17.0.9.8.923); the vulnerability resides in ajax_mod_security.php during parsing of the check_ip parameter, where user-supplied input is used to form a system call without proper validation, enabling remote code execution as root. Multiple sources (in...

CVE-2020-15420

CVE-2020-15420 affects CentOS Web Panel (cwp-el7-0.9.8.891). The flaw is in loader_ajax.php when parsing the line parameter, which is used to execute a system call without proper validation. This leads to remote code execution with root privileges and requires no authentication. The issue is docu...

CVE-2020-15420

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loaderajax.php. When parsing the line parameter, the process does not...

CVE-2020-15421

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmodsecurity.php. When parsing the checkip parameter, the process...

CVE-2020-15612 — CentOS Web Panel Authentication Bypass/RCE

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. When parsing the userLogin parameter, the process...