1928 matches found
CVE-2016-10789
CVE-2016-10789 affects cPanel prior to 60.0.25. The cpsrvd 403 error response handler can be exploited to achieve code execution (SEC-191). Multiple connected sources corroborate this vulnerability entry. Impact is high if exploited; remediation is to upgrade to 60.0.25 or later (i.e., non-vulner...
CVE-2016-10788
CVE-2016-10788 concerns cPanel prior to 60.0.25, where an arbitrary code execution vulnerability exists via Maketext in the PostgreSQL adminbin (SEC-188). The Red Hat and CVE records corroborate the same description. Affected product: cPanel; affected component: Maketext usage in PostgreSQL admin...
CVE-2016-10787
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...
CVE-2016-10786
The CVE-2016-10786 entry affects cPanel before 60.0.25, where members of the nobody group can read Apache HTTP Server SSL private keys (information disclosure). Root cause is insufficient access control permitting read access to SSL keys by unauthorized system users. Red Hat and CNVD entries corr...
CVE-2016-10785
CVE-2016-10785 affects cPanel prior to 60.0.25, where an attacker could disclose file contents during file copy operations (SEC-185). Root cause described as an information disclosure vulnerability in the file-copy process. The practical impact is information disclosure of file contents; exploita...
CVE-2016-10784
cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...
CVE-2016-10784
CVE-2016-10784 affects cPanel prior to 60.0.25, where the alias upload interface is vulnerable to self-XSS (SEC-184) due to insufficient input validation. The issue enables an attacker with access to the alias upload flow to inject and execute client-side code. The vulnerability was identified in...
CVE-2016-10783
CVE-2016-10783 affects cPanel before 60.0.25, where a self‑stored XSS is possible in SSL_listkeys due to insufficient validation in the web application. The vulnerability allows attacker‑controlled data to be stored and later reflected in the client, enabling cross‑site scripting. Affected produc...
CVE-2016-10782
CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...
CVE-2016-10782
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...
CVE-2016-10781
CVE-2016-10781 affects cPanel prior to 60.0.25, where the UI_confirm API is vulnerable to self-XSS due to insufficient validation of client-side data. The vulnerability can allow an attacker to execute client-side code via the UI_confirm interface, as described in the public records (SEC-180). Th...
CVE-2016-10779
CVE-2016-10779 affects cPanel prior to 60.0.25, with a stored XSS in api1_listautoresponders due to insufficient input validation in the web application. The vulnerability can lead to execution of client-side code in affected sessions. Remediation: upgrade to version 60.0.25 or later (as noted in...
CVE-2016-10779
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...
CVE-2016-10795: Improper Neutralization of Input During Web Page Generation
cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...
CVE-2016-10788: Improper Input Validation
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...
CVE-2016-10780: Improper Neutralization of Input During Web Page Generation
cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...
CVE-2016-10781: Improper Neutralization of Input During Web Page Generation
cPanel before 60.0.25 allows self XSS in the UIconfirm API SEC-180...
CVE-2016-10779: Improper Neutralization of Input During Web Page Generation
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...
