Improper access control

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...

Design/Logic Flaw

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

Design/Logic Flaw

cPanel before 60.0.25 allows self XSS in the UIconfirm API SEC-180...

Code injection

cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...

Code injection

cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...

Cross site scripting

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

Design/Logic Flaw

cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...

Code injection

cPanel before 60.0.25 allows attackers to discover file contents during file copy operations SEC-185...

Cross site scripting

cPanel before 60.0.25 allows self stored XSS in SSLlistkeys SEC-182...

Code injection

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Cross site scripting

cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination SEC-174...

Cross site scripting

cPanel before 60.0.25 allows self stored XSS in the listftpstable API SEC-178...

CVE-2016-10797

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...

CVE-2016-10797

The vulnerability CVE-2016-10797 affects cPanel/WHM prior to 58.0.4, where the WHM uy and Install an SSL Certificate page could disclose all server domains (information disclosure). Root cause is an exposure on the SSL certificate management page (SEC-133). Impact is information exposure of dom...

CVE-2016-10796

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files SEC-130...

CVE-2016-10796

CVE-2016-10796 affects cPanel prior to 58.0.4, where Apache HTTP Server log files are created with weak permissions (SEC-130). Root cause is a permissions misconfiguration leading to potential partial information disclosure. Impact is stated as low severity with LOCAL access. The recommended reme...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10794

cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error SEC-154...

CVE-2016-10794

The vulnerability CVE-2016-10794 affects cPanel prior to 59.9999.145. A multipart form processing error (SEC-154) allows arbitrary file-read operations. This is evidenced across multiple connected sources (e.g., Red Hat and CNVD entries) confirming the same issue. Affected product: cPanel web-bas...