1933 matches found
CVE-2019-14401
cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...
CVE-2019-14400
CVE-2019-14400 affects cPanel prior to 78.0.18. The vulnerability arises from userdata cache misparsing (SEC-479) and allows a local attacker to escalate privileges to root. The impact is described as complete confidentiality, integrity, and availability compromise for the affected host. Remediat...
CVE-2019-14398
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...
CVE-2019-14394
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetchsslcertificatesforfqdns API SEC-489...
CVE-2019-14394
CVE-2019-14394 affects cPanel prior to 80.0.5 where the fetch_ssl_certificates_for_fqdns API can perform unsafe file operations in the context of the root account. Multiple connected sources confirm this vulnerability exists in cPanel and describes an unsafe file operation flaw exploitable locall...
CVE-2019-14392
CVE-2019-14392 affects cPanel prior to 80.0.22, where incorrect URI dispatching enables remote code execution from a demo account (SEC-501). Impact: remote code execution with high severity; no in-wild exploit details provided in the sources. Remediation: upgrade to 80.0.22 or later. If known, ve...
CVE-2018-20867
CVE-2018-20867 affects cPanel prior to 76.0.8, with an open redirect when resetting connections (SEC-462). The provided documents confirm the affected product and vulnerability class; a patch is available in the 76.0.8 update (per the changelog reference). Root cause details are not provided in t...
CVE-2019-14390
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface SEC-512...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
Default credentials
cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...
Cross site scripting
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface SEC-512...
CVE-2019-14389
cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...
CVE-2019-14388
CVE-2019-14388 affects cPanel prior to 82.0.2, allowing unauthenticated file creation due to mishandled Exim log parsing (SEC-507). Root cause: improper handling of Exim logs enables file creation without authentication. Impact: unauthorized file creation; no explicit exploitation details provide...
CVE-2019-14387
CVE-2019-14387 affects cPanel before 82.0.2, with a Self XSS vulnerability in the cPanel and webmail master templates (SEC-506). Root cause is client-side script execution via crafted input in template code. Impact, per CVSS data, is MEDIUM: network access with exploitation requiring user interac...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
CVE-2019-14386
CVE-2019-14386 affects cPanel before 82.0.2, where a stored XSS vulnerability exists in the WHM Tomcat Manager interface (SEC-504). Impact is cross-site scripting; remediation is to upgrade to 82.0.2 or later (per provided sources). If exploitation details are not provided in the documents, note ...
CVE-2019-14412: Use of Externally-Controlled Format String
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
CVE-2018-20868: Improper Neutralization of Input During Web Page Generation
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...