4107 matches found
CVE-2019-14403
CVE-2019-14403 involves cPanel prior to 78.0.18 that allowed an open mail relay due to incorrect domain-redirect routing (SEC-483). The Red Hat advisory reiterates the issue for cPanel before 78.0.18. The CNVD entry also notes an input validation error in versions before 78.0.18. Impact is a mail...
CVE-2019-14402
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...
CVE-2019-14402
CVE-2019-14402 affects cPanel prior to 78.0.18. The root cause is unsafe terminal capability detection via infocmp, which could let an attacker infer endpoint functionality. The issue is categorized as low severity in CVSS metrics, with local access and no required user interaction. Fix: upgrade ...
CVE-2019-14401
cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...
CVE-2019-14401
CVE-2019-14401 affects cPanel prior to 78.0.18. An input validation/API path (addforward API1) can lead to code execution. Impact is described as potential remote code execution with partial/high impact per CVSS metrics. Remediation: upgrade to 78.0.18 or later (as indicated by multiple sources)....
CVE-2019-14400
CVE-2019-14400 affects cPanel prior to 78.0.18. The vulnerability arises from userdata cache misparsing (SEC-479) and allows a local attacker to escalate privileges to root. The impact is described as complete confidentiality, integrity, and availability compromise for the affected host. Remediat...
CVE-2019-14400
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing SEC-479...
CVE-2019-14399
The CVE-2019-14399 affects cPanel’s SSL certificate-storage feature prior to version 78.0.18, allowing unsafe file operations in the root context (SEC-477). The root-privilege impact is indicated by the CVSS data (high for CVSS3, medium for CVSS2). The available connected sources confirm the prod...
CVE-2019-14399
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...
CVE-2019-14398
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...
CVE-2019-14398
Summary (CVE-2019-14398) : cPanel prior to 80.0.5 contains an input validation/command-execution vulnerability in the ajax_maketext_syntax_util.pl component (SEC-498), enabling demo accounts to execute arbitrary code. The issue is exposed over network (no user interaction required) and has a high...
CVE-2019-14397
cPanel prior to 80.0.5 is affected by CVE-2019-14397. The vulnerability allows demo accounts to modify arbitrary files through the extractfile API1 call (SEC-496). Impact is limited to unauthorized file modifications on affected systems; no broader exploitation details are provided in the sources...
CVE-2019-14397
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
CVE-2019-14396
CVE-2019-14396 affects the API Analytics adminbin in cPanel prior to version 80.0.5. The vulnerability allows spoofed insertions of log data (SEC-495). Documents consistently describe the affected component and symptom but do not provide concrete exploit details, attack vectors, or in-the-wild ac...
CVE-2019-14396
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...
CVE-2019-14395
CVE-2019-14395 affects cPanel before 80.0.5, where the Queueprocd log used world-readable permissions, enabling potential information disclosure. Root cause: improper file permissions on the log, leading to exposure of sensitive data. Remediation: upgrade to cPanel 80.0.5 or later (as per vendor ...
CVE-2019-14395
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log SEC-494...
CVE-2019-14394
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetchsslcertificatesforfqdns API SEC-489...
CVE-2019-14394
CVE-2019-14394 affects cPanel prior to 80.0.5 where the fetch_ssl_certificates_for_fqdns API can perform unsafe file operations in the context of the root account. Multiple connected sources confirm this vulnerability exists in cPanel and describes an unsafe file operation flaw exploitable locall...