CVE-2016-10793

CVE-2016-10793 affects cPanel prior to 59.9999.145. The root cause is an incorrect #! in Mail::SPF scripts that enables arbitrary code execution. Affected software is cPanel versions before 59.9999.145; the vulnerability allows code execution with the privilege level of the web server. Remediatio...

CVE-2016-10793

cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect ! in Mail::SPF scripts SEC-152...

CVE-2016-10792

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...

CVE-2016-10792

CVE-2016-10792 affects cPanel prior to 59.9999.145. The vulnerability allows code execution in the context of other accounts via mailman list archives (SEC-141). This is the explicit impact described in connected references. The provided documents do not specify the exact vulnerable component or ...

CVE-2016-10791

CVE-2016-10791 affects cPanel before 60.0.15. The issue arises because the product does not ensure that system accounts lack a valid password, which can render logins impossible (CPANEL-9559). Connected sources consistently describe the same flaw, with no explicit details on affected versions bey...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10790

Summary: CVE-2016-10790 affects cPanel before 60.0.25, where HTTP POSTs to listinput.cpanel.net are sent without TLS. This allows potential in-transit data exposure; CVSS metrics indicate confidentiality impact (C) and high overall risk (CVSS v3 base score 7.5). Multiple connected sources corrobo...

CVE-2016-10790

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

CVE-2016-10789

CVE-2016-10789 affects cPanel prior to 60.0.25. The cpsrvd 403 error response handler can be exploited to achieve code execution (SEC-191). Multiple connected sources corroborate this vulnerability entry. Impact is high if exploited; remediation is to upgrade to 60.0.25 or later (i.e., non-vulner...

CVE-2016-10789

cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...

CVE-2016-10788

CVE-2016-10788 concerns cPanel prior to 60.0.25, where an arbitrary code execution vulnerability exists via Maketext in the PostgreSQL adminbin (SEC-188). The Red Hat and CVE records corroborate the same description. Affected product: cPanel; affected component: Maketext usage in PostgreSQL admin...

CVE-2016-10788

cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...

CVE-2016-10787

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...

CVE-2016-10787

The CVE-2016-10787 entry affects cPanel’s Host Access Control feature prior to version 60.0.25, where actionless host.deny entries are mishandled (SEC-187). The vulnerability’s technical basis is the misprocessing of host.deny entries, with an external exploit path not described in the provided d...

CVE-2016-10786

cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...

CVE-2016-10786

The CVE-2016-10786 entry affects cPanel before 60.0.25, where members of the nobody group can read Apache HTTP Server SSL private keys (information disclosure). Root cause is insufficient access control permitting read access to SSL keys by unauthorized system users. Red Hat and CNVD entries corr...

CVE-2016-10785

CVE-2016-10785 affects cPanel prior to 60.0.25, where an attacker could disclose file contents during file copy operations (SEC-185). Root cause described as an information disclosure vulnerability in the file-copy process. The practical impact is information disclosure of file contents; exploita...

CVE-2016-10785

cPanel before 60.0.25 allows attackers to discover file contents during file copy operations SEC-185...

CVE-2016-10784

cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...

CVE-2016-10784

CVE-2016-10784 affects cPanel prior to 60.0.25, where the alias upload interface is vulnerable to self-XSS (SEC-184) due to insufficient input validation. The issue enables an attacker with access to the alias upload flow to inject and execute client-side code. The vulnerability was identified in...