4110 matches found
Sql injection
cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...
Code injection
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
Design/Logic Flaw
cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...
Code injection
cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...
Cross site scripting
cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface SEC-391...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...
Design/Logic Flaw
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...
Code injection
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck SEC-81...
Authentication flaw
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...
Cross site scripting
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...
Cross site scripting
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...
Code injection
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...
CVE-2018-20946
cPanel before 68.0.27 exposes zone information because the archive_sync_zones script creates a world‑readable archive. This info disclosure vulnerability is documented across CVE‑2018‑20946 entries (NVD, RH, CNVD, etc.). Impact is information exposure of zones; CVSS v3 score is Low (3.3) with loc...
CVE-2018-20946
cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...
CVE-2018-20945
bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...
CVE-2018-20945
The CVE-2018-20945 issue affects cPanel prior to 68.0.27 (bin/csvprocess) and enables insecure file operations due to SEC-354. Affected product: cPanel / web hosting control panel. Root cause details are consistently described across connected records as insecure file handling in bin/csvprocess b...
CVE-2018-20944
CVE-2018-20944 affects cPanel before 68.0.27, where an attacker can read a copy of httpd.conf that is created during a syntax test (SEC-353). The underlying issue is an information-disclosure vector within the syntax-test workflow.