CVE-2018-20915

CVE-2018-20915 affects cPanel before 70.0.23, allowing a stored XSS via the WHM Edit DNS Zone action (SEC-369). Affected product: cPanel/WHM DNS zone editing flow. The vulnerability is triggered by input in the DNS zone editing path and results in stored XSS; exploitation details are not provided...

CVE-2018-20915

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-369...

CVE-2016-10853

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface SEC-86...

CVE-2016-10853

Summary: CVE-2016-10853 affects cPanel before 11.54.0.4, with a stored XSS vulnerability in the WHM Feature Manager interface (SEC-86). Multiple connected sources (NVD/NVD mirror, Red Hat security page, CNVD) corroborate this description. What’s vulnerable: The WHM Feature Manager component of cP...

CVE-2018-20914

CVE-2018-20914 affects cPanel before 70.0.23. OpenID providers can inject arbitrary data into cPanel session files (SEC-368), enabling manipulation of session state and potentially impacting the confidentiality and integrity of session data. Affected versions are cPanel prior to 70.0.23. Mitigati...

CVE-2018-20914

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...

CVE-2016-10854

CVE-2016-10854 affects cPanel prior to 11.54.0.4, where the X3 Entropy Banner interface is vulnerable to a self XSS. The description is corroborated across multiple feeds (e.g., NVD and RH advisories) as a self-XSS in the X3 Entropy Banner. The available sources do not provide exploit details or ...

CVE-2016-10854

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

CVE-2018-20913

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

CVE-2018-20913

CVE-2018-20913 affects cPanel before 70.0.23. The vulnerability allows an attacker to read the root accesshash via the WHM path /cgi/trustclustermaster.cgi (SEC-364). The available sources describe the vulnerability as an information disclosure condition impacting the root accesshash, with no pub...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

CVE-2018-20912

Summary: CVE-2018-20912 affects cPanel before 70.0.23, where demo accounts could cause code execution via awstats (SEC-362). The issue is reported across multiple sources (e.g., Red Hat and CNVD entries) with the consistent description that vulnerable versions prior to 70.0.23 permit arbitrary co...

CVE-2016-10855

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd SEC-91...

CVE-2016-10855

CVE-2016-10855 affects cPanel before 11.54.0.4, where cpsrvd allows unauthenticated arbitrary code execution (SEC-91). The vulnerability is documented across multiple feeds (NVD/Red Hat/CNVD) with no indication of affected other versions beyond pre-11.54.0.4. The standard remediation is upgrading...

CVE-2018-20911

cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup SEC-359...

CVE-2018-20911

CVE-2018-20911 affects cPanel before 70.0.23. The root cause is a Perl syntax check failure in cpaddonsup caused by a dot (.) being in @INC, enabling code execution. The vulnerability results in code execution, with impact described as such in the sources. Remediation: apply the fixed version 70....

CVE-2016-10856

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

CVE-2016-10856

CVE-2016-10856 affects cPanel prior to 11.54.0.0, where subaccounts can disclose sensitive data through comet feeds (SEC-29). The provided connected sources confirm the affected product/version range and the data exposure vector but do not specify deeper root cause or exploit details. No explicit...

CVE-2016-10857

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...

CVE-2016-10857

CVE-2016-10857 affects cPanel prior to 11.54.0.0, with a bypass of the e-mail sending limit (SEC-60). The Red Hat and other feeds corroborate this description. The concrete root cause, impacted components, and exact exploit details are not provided in the documents; no explicit remediation steps ...