1926 matches found
CVE-2020-29136
CVE-2020-29136 affects cPanel versions prior to 90.0.17, where an authentication bypass allows 2FA to be defeated via brute-force (SEC-575). Root cause: improper enforcement of multi-factor authentication during brute-force attempts. Impact: unauthorized access by bypassing 2FA; exploitation stat...
CVE-2020-29136
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...
CVE-2020-29137
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...
CVE-2020-29135
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
CVE-2020-29135
CVE-2020-29135 affects cPanel prior to 90.0.17, with multiple instances of URL parameter injection (SEC-567). The connected records identify the affected product and the vulnerability type, but do not provide explicit exploitation details, affected components beyond the web interfaces, or a confi...
CVE-2020-29137: Improper Neutralization of Input During Web Page Generation
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...
CVE-2020-29135: Inappropriate Encoding for Output Context
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
This Week in Security News: US Cyber Command Exposes New Russian Malware and REvil Ransomware Gang ‘Acquires’ KPOT Malware
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about eight new malware samples that were developed and deployed by Russian hackers in recent attacks. Also, read about how the operators ...
Toymaker Mattel Hit by Ransomware Attack
Top toymaker Mattel revealed it was a victim of a ransomware attack that successfully encrypted some data and temporarily crippled a limited number of business functions. The disclosure was part of a U.S. Securities Exchange Commission SEC disclosure filed in late October. Mattel reported the...
CVE-2020-26115
cPanel before 90.0.10 allows self XSS via the Cron Editor interface SEC-574...
CVE-2020-26113
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...
CVE-2020-26109
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...
CVE-2020-26106
cPanel before 88.0.3 has weak permissions world readable for the proxy subdomains log file SEC-558...
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape SEC-497...
Design/Logic Flaw
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...
Design/Logic Flaw
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...
Design/Logic Flaw
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...
Code injection
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM SEC-550...