awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.

Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory.

Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3714 to the following vulnerability:

Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the querystring, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.

References:

http://bugs.gentoo.org/showbug.cgi?id=235225

Upstream patch:

http://awstats.cvs.sourceforge.net/awstats/awstats/wwwroot/cgi-bin/awstats.pl?r1=1.910&r2=1.912

Upstream bug report:

http://sourceforge.net/tracker/index.php?func=detail&aid=2001151&groupid=13764&atid=113764

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the querystring parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.