An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and...
7.2CVSS
6.9AI Score
0.001EPSS
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads...
8.1CVSS
8AI Score
0.002EPSS
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files...
7.5CVSS
7.6AI Score
0.001EPSS
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure...
5.5CVSS
5.3AI Score
0.0004EPSS
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files...
8.1CVSS
8AI Score
0.001EPSS
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files...
4.4CVSS
4.8AI Score
0.0004EPSS
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks...
7.2CVSS
6.9AI Score
0.001EPSS
6.1CVSS
6.3AI Score
0.001EPSS
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension...
7.5CVSS
7.5AI Score
0.001EPSS
7.5CVSS
7.5AI Score
0.001EPSS
6.5CVSS
6.8AI Score
0.001EPSS
4.1CVSS
7.7AI Score
0.001EPSS
6.1CVSS
7.4AI Score
0.001EPSS
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM...
7.5CVSS
7.5AI Score
0.002EPSS
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution...
9.8CVSS
8AI Score
0.004EPSS
6.1CVSS
6.2AI Score
0.001EPSS
6.1CVSS
6.2AI Score
0.001EPSS
9.8CVSS
7.3AI Score
0.002EPSS
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM...
9.8CVSS
7.4AI Score
0.003EPSS
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM...
9.8CVSS
7.4AI Score
0.003EPSS
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys...
7.5CVSS
7.4AI Score
0.002EPSS
6.1CVSS
6.2AI Score
0.001EPSS
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution...
9.8CVSS
8.4AI Score
0.006EPSS
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file...
7.5CVSS
7.5AI Score
0.002EPSS
7.5CVSS
7.4AI Score
0.002EPSS
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM...
7.5CVSS
7.4AI Score
0.002EPSS
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification...
7.5CVSS
7.3AI Score
0.001EPSS
7.5CVSS
7.4AI Score
0.001EPSS
6.1CVSS
6.2AI Score
0.001EPSS
6.1CVSS
6.2AI Score
0.001EPSS
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism...
7.5CVSS
7.3AI Score
0.001EPSS
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings...
5.3CVSS
7.5AI Score
0.002EPSS
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature...
8.1CVSS
7.2AI Score
0.001EPSS
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs...
9.8CVSS
9.5AI Score
0.005EPSS
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files...
6.5CVSS
6.5AI Score
0.001EPSS
6.1CVSS
6.2AI Score
0.001EPSS
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls...
9.1CVSS
9AI Score
0.002EPSS
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently...
8.8CVSS
7.6AI Score
0.001EPSS
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file...
8.8CVSS
7.8AI Score
0.001EPSS
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing...
5.5CVSS
7.5AI Score
0.0004EPSS
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect...
9.8CVSS
7.6AI Score
0.002EPSS
In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers...
3.3CVSS
7.4AI Score
0.0004EPSS
cPanel before 84.0.20 allows self XSS via a temporary character-set specification...
6.1CVSS
5.9AI Score
0.001EPSS
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls...
5.3CVSS
5.4AI Score
0.001EPSS
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell...
9.8CVSS
9.7AI Score
0.014EPSS
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell...
7.2CVSS
7.4AI Score
0.006EPSS
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace...
9.1CVSS
9.1AI Score
0.002EPSS
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming...
6.5CVSS
7.3AI Score
0.001EPSS
5.4CVSS
5.9AI Score
0.001EPSS