4118 matches found
Code injection
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...
Code injection
cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...
Code injection
cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation SEC-266...
Code injection
cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...
Design/Logic Flaw
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...
Design/Logic Flaw
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
Buffer overflow
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing SEC-269...
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...
Code injection
In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...
Code injection
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...
Design/Logic Flaw
In cPanel before 66.0.2, domain log files become readable after log processing SEC-273...
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...
CVE-2017-18438
CVE-2017-18438 affects cPanel prior to 64.0.21. The issue allows a demo account to execute code through Encoding API calls (SEC-242), enabling code execution with what is described as low privilege, network-remote access. The provided connected documents confirm the vulnerability exists in the cP...
CVE-2017-18438
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...
CVE-2017-18437
CVE-2017-18437 affects cPanel prior to 64.0.21, where a Webmail account can execute code via forwarders (SEC-240). Impact is code execution with Webmail privileges; CVSS data shows LOW to MEDIUM base scores (C/L/I/P). Remediation: upgrade to 64.0.21 or newer to fix the vulnerability. Other detail...
CVE-2017-18437
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...
CVE-2017-18436
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...
CVE-2017-18436
The CVE-2017-18436 issue affects cPanel prior to 64.0.21, where demo accounts can read files via the Fileman::getfileactions API2 call (SEC-239). Root cause: insufficient access control in the Fileman API allowing read access to files. Impact: potential partial disclosure of file contents for dem...