CVE-2016-10783

cPanel before 60.0.25 allows self stored XSS in SSLlistkeys SEC-182...

CVE-2016-10777

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

CVE-2016-10782

cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...

CVE-2016-10780

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

CVE-2016-10787

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...

Cross site scripting

cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...

Design/Logic Flaw

cPanel before 60.0.25 allows self XSS in the UIconfirm API SEC-180...

Improper access control

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...

Design/Logic Flaw

cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...

Code injection

cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...

Design/Logic Flaw

cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...

Code injection

cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...

Cross site scripting

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

Code injection

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Cross site scripting

cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination SEC-174...

CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10794

cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error SEC-154...

CVE-2016-10793

CVE-2016-10793 affects cPanel prior to 59.9999.145. The root cause is an incorrect #! in Mail::SPF scripts that enables arbitrary code execution. Affected software is cPanel versions before 59.9999.145; the vulnerability allows code execution with the privilege level of the web server. Remediatio...

CVE-2016-10789

CVE-2016-10789 affects cPanel prior to 60.0.25. The cpsrvd 403 error response handler can be exploited to achieve code execution (SEC-191). Multiple connected sources corroborate this vulnerability entry. Impact is high if exploited; remediation is to upgrade to 60.0.25 or later (i.e., non-vulner...

CVE-2016-10788

CVE-2016-10788 concerns cPanel prior to 60.0.25, where an arbitrary code execution vulnerability exists via Maketext in the PostgreSQL adminbin (SEC-188). The Red Hat and CVE records corroborate the same description. Affected product: cPanel; affected component: Maketext usage in PostgreSQL admin...