4118 matches found
Code injection
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding SEC-247...
Design/Logic Flaw
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename SEC-223...
Design/Logic Flaw
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade SEC-257...
Design/Logic Flaw
cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...
Design/Logic Flaw
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...
Design/Logic Flaw
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...
Code injection
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call SEC-243...
Code injection
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...
Code injection
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...
CVE-2017-18463
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...
CVE-2017-18463
CVE-2017-18463 affects cPanel versions prior to 62.0.17. An attacker can achieve code execution in the root account context through manipulation of a long DocumentRoot path (SEC-225). The available connected sources confirm the vulnerability description across Red Hat, CNVD/PRION listings and CVE...
CVE-2017-18461
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename SEC-223...
CVE-2017-18461
CVE‑2017‑18461 affects cPanel prior to 62.0.17, where security policy questions are not preserved across an account rename (SEC‑223). The NVD entry lists CVSS‑v3 base 4.3 (NETWORK, HIGH? actually LOW; see vector) and CVSS‑v2 base 5.0, with impact: integrity Low, otherwise None; exploitability low...
CVE-2017-18460
CVE-2017-18460 affects cPanel before 62.0.17, where the automatic SSL installation process allows arbitrary code execution (SEC-221). Affected: cPanel (pre-62.0.17). Root cause: vulnerability in SSL installation flow enabling code execution. Impact: arbitrary code execution with HIGH severity (pe...
CVE-2017-18460
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...
CVE-2017-18459
cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...
CVE-2017-18459
CVE-2017-18459 affects cPanel prior to 62.0.17, where an arbitrary code execution flaw can occur during account modification (SEC-220). Multiple connected sources corroborate that the issue resides in cPanel’s account-modification workflow and allows code execution with local access, high impact,...
CVE-2017-18458
CVE-2017-18458 affects cPanel prior to 62.0.17. The issue allows a file to be overwritten when renaming an account (SEC-219). Primary information comes from cPanel advisories and vendor records; no exploit details are provided in the documents. The available sources confirm the affected product/v...