4118 matches found
CVE-2017-18447
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...
CVE-2017-18445
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls SEC-249...
Code injection
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers SEC-208...
Design/Logic Flaw
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...
Code injection
cPanel before 64.0.21 allows code execution via Rails configuration files SEC-259...
Code injection
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...
Code injection
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...
Code injection
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
Design/Logic Flaw
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...
Code injection
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...
Code injection
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...
Design/Logic Flaw
cPanel before 64.0.21 allows demo accounts to execute SSH API commands SEC-248...
Code injection
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...
Design/Logic Flaw
cPanel before 64.0.21 does not preserve supplemental groups across account renames SEC-260...
Code injection
cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...
Code injection
cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...
Code injection
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...
Cross site scripting
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...