5008 matches found
CVE-2018-20866: Improper Neutralization of Input During Web Page Generation
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...
CVE-2018-20863: Improper Input Validation
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...
CVE-2019-14405: Undefined Security Weakness
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg SEC-487...
CVE-2019-14388: Undefined Security Weakness
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled SEC-507...
FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)
the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag does not close in the HTML being parsed. Because...
spamassassin -- multiple vulnerabilities
the Apache Spamassassin project reports: In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag does not close in the HTML being parsed. Because ...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
Cross site scripting
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
CVE-2018-16236 affects cPanel through version 74, allowing XSS via a crafted filename in the logs subdirectory of a user account. The root cause is that the filename is mishandled during rendering of frontend/THEME/raw/index.html, enabling script injection. Exploit details (in-the-wild, vectors) ...
CVE-2018-16236: Improper Neutralization of Input During Web Page Generation
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
PT-2018-13449
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 74 Description The issue allows for XSS attacks via a crafted filename in the logs subdirectory of a user account. This occurs because the filename is mishandled during rendering of frontend/THEME/raw/index.html...
cPanel Filename Based Stored XSS < v76 Exploit
Usage Info Create a file as named with your payload in /home/user/logs directory or run the php exploit. + Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "...
cPanel 76 Cross Site Scripting
Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "'; // end of the script. ? Note: You cant create a file as named with / slash character by this exploit. This vulnerability is...
CVE-2018-7734
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request...
CVE-2018-7735
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=listfiletypes request...
CVE-2018-7734
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request...
CVE-2018-7735
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=listfiletypes request...
Debian DSA-4092-1 : awstats - security update
The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...