9101 matches found
CVE-2017-18446
CVE-2017-18446 affects cPanel prior to 64.0.21. The issue allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). The Red Hat/CNVD/EUVD/ENISA entries corroborate the core description. Impact as stated is potential access to restricted files and modificati...
CVE-2017-18444
CVE-2017-18444 affects cPanel before 64.0.21, enabling demo accounts to execute SSH API commands (SEC-248). Multiple sources (NVD, Red Hat, CNVD) confirm the impact. The provided documents do not specify the underlying root cause, affected component details, exact exploit vectors, or a confirmed ...
CVE-2017-18444
cPanel before 64.0.21 allows demo accounts to execute SSH API commands SEC-248...
CVE-2017-18443
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding SEC-247...
CVE-2017-18442
CVE-2017-18442 : Affected software is cPanel prior to 64.0.21. The issue allows demo accounts to trigger Cpanel::SPFUI API commands (SEC-246), implying limited privilege elevation within the control panel API. The description and connected documents do not provide additional exploitation details ...
CVE-2017-18442
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...
CVE-2017-18441
cPanel before 64.0.21 is affected. Across multiple sources, the vulnerability is described as an input validation error in cPanel prior to 64.0.21 that allows a demo account to redirect web traffic (SEC-245). The Red Hat/Cnvd entries confirm the same flaw and tie it to versions pre-64.0.21, with ...
CVE-2017-18439
CVE-2017-18439 affects cPanel before 64.0.21. A demo account can trigger code execution via the ImageManager_dimensions API call (SEC-243). The remedial version is 64.0.21 or later. Additional references corroborate the issue across multiple advisories.
CVE-2017-18435
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...
CVE-2017-18433
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...
CVE-2017-18431
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts CPANEL-13941...
CVE-2017-18421
cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...
CVE-2017-18421
cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...
Code injection
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...
Code injection
cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...
CVE-2017-18438
CVE-2017-18438 affects cPanel prior to 64.0.21. The issue allows a demo account to execute code through Encoding API calls (SEC-242), enabling code execution with what is described as low privilege, network-remote access. The provided connected documents confirm the vulnerability exists in the cP...
CVE-2017-18438
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...
CVE-2017-18436
The CVE-2017-18436 issue affects cPanel prior to 64.0.21, where demo accounts can read files via the Fileman::getfileactions API2 call (SEC-239). Root cause: insufficient access control in the Fileman API allowing read access to files. Impact: potential partial disclosure of file contents for dem...
CVE-2017-18435
This CVE affects cPanel before 64.0.21, where demo accounts could cause code execution via the BoxTrapper API (SEC-238). The issue is tied to the BoxTrapper API and is documented as exploitable by non-privileged, unauthenticated users, enabling remote code execution with low attacker effort. The ...