CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Awstats » Awstats : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4369 22 Dir. Trav. 2010-12-02 2011-02-23
6.4
None Remote Low Not required Partial Partial None
Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory.
2 CVE-2010-4368 94 Exec Code 2010-12-02 2010-12-03
7.5
None Remote Low Not required Partial Partial Partial
awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.
3 CVE-2010-4367 94 Exec Code 2010-12-02 2011-02-23
7.5
None Remote Low Not required Partial Partial Partial
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.
4 CVE-2009-5020 20 2010-12-02 2010-12-02
5.8
None Remote Medium Not required None Partial Partial
Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
5 CVE-2008-5080 79 XSS 2008-12-03 2009-03-04
4.3
None Remote Medium Not required None Partial None
awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
6 CVE-2008-3714 79 XSS 2008-08-19 2009-03-07
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.
7 CVE-2006-3682 2006-07-21 2008-10-09
5.0
None Remote Low Not required Partial None None
awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
8 CVE-2006-3681 XSS 2006-07-21 2008-10-09
2.6
None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
9 CVE-2006-2644 Exec Code 2006-05-30 2008-09-05
4.0
None Remote Low Single system None Partial None
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
10 CVE-2006-2237 Exec Code 2006-05-08 2008-09-05
5.1
User Remote High Not required Partial Partial Partial
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
11 CVE-2006-1945 XSS 2006-04-20 2008-11-03
2.6
None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.
12 CVE-2005-2732 +Info 2005-08-30 2008-09-05
5.0
None Remote Low Not required Partial None None
AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, which reveals the path in an error message.
13 CVE-2005-1527 Exec Code 2005-08-15 2008-09-05
5.0
None Remote Low Not required None Partial None
Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.
14 CVE-2005-0438 +Info 2005-05-02 2008-09-05
5.0
None Remote Low Not required Partial None None
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.
15 CVE-2005-0437 Dir. Trav. 2005-05-02 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in the loadplugin parameter.
16 CVE-2005-0436 Exec Code 2005-05-02 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.
17 CVE-2005-0435 2005-05-02 2008-09-05
5.0
None Remote Low Not required Partial None None
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.
18 CVE-2005-0363 Exec Code 2005-05-02 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.
19 CVE-2005-0362 Exec Code 2005-02-09 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.
20 CVE-2005-0116 20 1 Exec Code 2005-01-18 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
Total number of vulnerabilities : 20   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.