4107 matches found
CVE-2019-14410
CVE-2019-14410 affects cPanel prior to 78.0.2. Maketext in the Email store_filter UAPI allows a format-string injection vulnerability (SEC-472). The issue is described as a formatting string error in cPanel’s UI/automation layer, with a local attack surface and low CVSS scores reported. Affected ...
CVE-2019-14409
CVE-2019-14409 affects cPanel prior to 78.0.2. The issue allows arbitrary file-read via Passenger adminbin, causing information disclosure. Root cause: flaw in how Passenger adminbin handles file access. Impact: partial confidentiality loss with local access. Mitigation: upgrade to cPanel 78.0.2 ...
CVE-2019-14409
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2018-20867
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2018-20867
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2019-14408
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
CVE-2019-14408
CVE-2019-14408 affects cPanel before 78.0.2. Affected component: the web-based cPanel interface; root cause described as an input validation issue that allows a demo account to link with an OpenID provider (SEC-460). Consequence: sanctioned links to an OpenID provider by a non-privileged/demo acc...
Remote code execution
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
Open redirect
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2019-14407
cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...
CVE-2019-14407
CVE-2019-14407 affects cPanel before 78.0.2, where internal data is disclosed to OpenID providers (SEC-415). Public sources (NVD, Red Hat, CNVD) confirm that versions prior to 78.0.2 are affected and describe an information-disclosure vulnerability tied to configuration/operation errors. The prac...
CVE-2019-14406
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing SEC-493...
CVE-2019-14406
CVE-2019-14406 affects cPanel before 78.0.18, with a stored XSS in the BoxTrapper Queue Listing (SEC-493). Root cause: lack of proper validation of client-side data by the web application. Impact is consistent with stored XSS in the affected component; exploitation details are not provided in the...
CVE-2019-14405
CVE-2019-14405 affects cPanel prior to 78.0.18. The vulnerability allows demo accounts to execute code via securitypolicy.cg (SEC-487), enabling potential remote code execution with partial to high impact (per CVSS v2/v3: base scores 6.5/8.8). Affected software is cPanel; root cause details are n...
CVE-2019-14405
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg SEC-487...
CVE-2019-14404
CVE-2019-14404 affects cPanel prior to 78.0.18, permitting certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Impact is information disclosure; no exploit details provided beyond this. Remediation: upgrade to cPanel 78.0.18 or later (p...