1926 matches found
CVE-2020-10118
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...
CVE-2019-20493
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...
CVE-2019-20490
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...
Code injection
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...
Design/Logic Flaw
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
Code injection
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...
CVE-2020-10121
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...
CVE-2020-10120
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...
CVE-2020-10119
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...
CVE-2020-10118
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...
CVE-2020-10117
CVE-2020-10117 affects cPanel prior to 84.0.20, where enforcement of demo checks in the Market UAPI namespace is mishandled (SEC-542). The issue enables weaknesses in access/validation that could impact confidentiality and integrity (per CVSS3.1: High, with Network access and no user interaction)...
CVE-2020-10114
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...
CVE-2020-10113
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
CVE-2019-20498
CVE-2019-20498 affects cPanel prior to 82.0.18. The issue is a WebDAV authentication bypass caused by incorrect connection-sharing logic (SEC-534). Reported across multiple feeds, the vulnerability explicitly impacts WebDAV authentication. Affected component: cPanel WebDAV handling; root cause: f...
CVE-2019-20495
CVE-2019-20495 affects cPanel; prior to version 82.0.18, an attacker can read an arbitrary database via a MySQL dump stream. Impact is partial confidentiality breach (read access). Remediation: upgrade to 82.0.18 or newer. Exploitation status not provided in the documents.
CVE-2019-20494
In cPanel before 82.0.18, the RNG function Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Affected product: cPanel (web hosting control panel). Vulnerable component: Cpanel::Rand::Get. Root cause: RNG predictability leads to low-entropy sequences. Impact: potential infor...
CVE-2019-20493
CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...
CVE-2019-20493
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...