Show filters
28 Total Results
Displaying 11-20 of 28
Sort by:
Attacker Value
Unknown
CVE-2008-5080
Disclosure Date: December 03, 2008 (last updated November 08, 2023)
awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
0
Attacker Value
Unknown
CVE-2008-3921
Disclosure Date: September 04, 2008 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameter.
0
Attacker Value
Unknown
CVE-2008-3922
Disclosure Date: September 04, 2008 (last updated October 04, 2023)
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
0
Attacker Value
Unknown
CVE-2008-3714
Disclosure Date: August 19, 2008 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.
0
Attacker Value
Unknown
CVE-2006-3681
Disclosure Date: July 21, 2006 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
0
Attacker Value
Unknown
CVE-2006-3682
Disclosure Date: July 21, 2006 (last updated October 04, 2023)
awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
0
Attacker Value
Unknown
CVE-2006-2644
Disclosure Date: May 30, 2006 (last updated October 04, 2023)
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
0
Attacker Value
Unknown
CVE-2006-2237
Disclosure Date: May 08, 2006 (last updated October 04, 2023)
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
0
Attacker Value
Unknown
CVE-2006-1945
Disclosure Date: April 20, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.
0
Attacker Value
Unknown
CVE-2005-2732
Disclosure Date: August 30, 2005 (last updated October 04, 2023)
AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, which reveals the path in an error message.
0
