4118 matches found
Design/Logic Flaw
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...
Input validation
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases SEC-283...
Code injection
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...
Code injection
cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...
Cross site scripting
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...
Code injection
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...
Design/Logic Flaw
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...
Code injection
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...
Sql injection
cPanel before 67.9999.103 allows SQL injection during eximstats processing SEC-276...
Cross site scripting
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...
Design/Logic Flaw
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...
Code injection
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...
CVE-2017-18416
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...
CVE-2017-18416
CVE-2017-18416 affects cPanel prior to 67.9999.103. The issue allows arbitrary file-overwrite during a Roundcube SQLite schema update (SEC-303). Connected sources confirm the vulnerability is tied to cPanel’s handling of the Roundcube SQLite schema update, enabling overwriting of arbitrary files....
CVE-2017-18415
CVE-2017-18415 affects cPanel prior to 67.9999.103. The issue is an incorrect environment-variable filtering vulnerability that allows code execution in the context of the mailman account (SEC-302). Root cause: improper handling of environment variables in the affected code path. Impact per refer...
CVE-2017-18415
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...
CVE-2017-18414
cPanel prior to 67.9999.103 contains an open redirect vulnerability in /unprotected/redirect.html (SEC-300). Concrete details across connected sources confirm affected product (cPanel), vulnerable component (redirect handling), and fixed version 67.9999.103. References call this an open redirect ...
CVE-2017-18414
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...
CVE-2017-18413
CVE-2017-18413 affects cPanel prior to 67.9999.103. The backup system can overwrite the root user’s home directory when a mounted volume disappears (SEC-299), exposing potential data integrity risk locally. The available connected records confirm the affected component/behavior and cite the speci...