1933 matches found
Design/Logic Flaw
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...
Design/Logic Flaw
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...
Cross site scripting
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing SEC-493...
CVE-2018-20869
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...
CVE-2018-20868
cPanel before 76.0.8 contains a Stored XSS in the WHM MultiPHP Manager interface (SEC-464). Affected product: cPanel/WHM (MultiPHP Manager); vulnerable component: stored XSS in the interface. Root cause: vulnerability described as Stored XSS; the exact exploit details are not provided in the docu...
CVE-2018-20866
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...
CVE-2018-20863
CVE-2018-20863 affects cPanel prior to 76.0.8, where remote attackers can achieve arbitrary code execution via mailing-list attachments (SEC-452). The CVE entry is corroborated across multiple sources (NVD, Red Hat, CNVD, CVE List). Patches exist (76.0.8+), but exploitation details are not elabor...
CVE-2018-20863
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...
CVE-2019-14414
CVE-2019-14414 affects cPanel before 78.0.2, where a Userdata cache temporary file can conflict with domains (SEC-478). The vulnerability concerns the Userdata cache handling and is documented with a Low severity (CVSSv2/3: low, local access, partial integrity impact). Exploitation details are no...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
CVE-2019-14410
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14409
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2019-14408
CVE-2019-14408 affects cPanel before 78.0.2. Affected component: the web-based cPanel interface; root cause described as an input validation issue that allows a demo account to link with an OpenID provider (SEC-460). Consequence: sanctioned links to an OpenID provider by a non-privileged/demo acc...
Open redirect
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
Remote code execution
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2019-14407
cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...
CVE-2019-14406
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing SEC-493...
CVE-2019-14405
CVE-2019-14405 affects cPanel prior to 78.0.18. The vulnerability allows demo accounts to execute code via securitypolicy.cg (SEC-487), enabling potential remote code execution with partial to high impact (per CVSS v2/v3: base scores 6.5/8.8). Affected software is cPanel; root cause details are n...