CVE-2020-10118

CVE-2020-10118 affects cPanel before 84.0.20 via the Branding API, where a demo account can modify files. The Red Hat/CNVD entries corroborate the same issue (file modification via Branding API). The vulnerability is tied to cPanel’s Branding API handling, enabling unauthorized file changes with ...

CVE-2020-10117

CVE-2020-10117 affects cPanel prior to 84.0.20, where enforcement of demo checks in the Market UAPI namespace is mishandled (SEC-542). The issue enables weaknesses in access/validation that could impact confidentiality and integrity (per CVSS3.1: High, with Network access and no user interaction)...

CVE-2020-10117

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

CVE-2020-10116

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

CVE-2020-10116

CVE-2020-10116 affects cPanel prior to 84.0.20. An attacker can bypass restrictions on features and demo accounts via WebDisk UAPI calls, enabling a restriction-bypass condition (SEC-541). The issue is tied to versions before 84.0.20; upgrade to 84.0.20 or later to remediate.

CVE-2020-10115

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. SEC-537...

CVE-2020-10115

CVE-2020-10115 affects cPanel before 84.0.20 when PowerDNS is used, enabling arbitrary code execution as root via the dnsadmin account. This vulnerability is corroborated across multiple sources (NVD, Red Hat, CNVD, CVE list) with the same core impact and affected condition. The root cause is imp...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

CVE-2020-10114 affects cPanel prior to 84.0.20. The vulnerability is described as a stored self‑XSS via the HTML file editor (SEC-535). The connected documents do not provide additional technical details such as affected components beyond the editor, exploit vectors, or concrete remediation steps...

CVE-2020-10113

CVE-2020-10113 affects cPanel prior to 84.0.20. The issue is a self-XSS via a temporary character-set specification (SEC-515). Multiple connected sources (Red Hat, CNVD) confirm the same description, with CNVD explicitly noting versions prior to 84.0.20. The impact is limited to client-side execu...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20498

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

CVE-2019-20498

CVE-2019-20498 affects cPanel prior to 82.0.18. The issue is a WebDAV authentication bypass caused by incorrect connection-sharing logic (SEC-534). Reported across multiple feeds, the vulnerability explicitly impacts WebDAV authentication. Affected component: cPanel WebDAV handling; root cause: f...

CVE-2019-20497

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration SEC-533...

CVE-2019-20497

The CVE-2019-20497 vulnerability affects cPanel prior to version 82.0.18, allowing stored XSS via the WHM Backup Restoration feature. Root cause details are not further described in the provided documents beyond the XSS via backup restore path. No exploit specifics, mitigations, or confirmed patc...

CVE-2019-20496

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...

CVE-2019-20496

Summary: CVE-2019-20496 affects cPanel prior to 82.0.18, where log processing can trigger arbitrary chown operations as root. Affected software: cPanel (prior to 82.0.18). Root cause / impact: An unauthorized chown operation is possible during log processing, granting root-level ownership changes...

CVE-2019-20495

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming SEC-531...

CVE-2019-20495

CVE-2019-20495 affects cPanel; prior to version 82.0.18, an attacker can read an arbitrary database via a MySQL dump stream. Impact is partial confidentiality breach (read access). Remediation: upgrade to 82.0.18 or newer. Exploitation status not provided in the documents.

CVE-2019-20494

In cPanel before 82.0.18, the RNG function Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Affected product: cPanel (web hosting control panel). Vulnerable component: Cpanel::Rand::Get. Root cause: RNG predictability leads to low-entropy sequences. Impact: potential infor...