1928 matches found
CVE-2017-18421
cPanel prior to 66.0.2 contains a vulnerability (SEC-271) that allows demo accounts to create databases and users. Affected: cPanel before 66.0.2. Root cause specifics are not detailed in the provided documents. Impact stated as unauthorized creation/management of databases and users. Remediation...
CVE-2017-18419
CVE-2017-18419 affects cPanel before 66.0.2. The issue is a stored XSS during WHM cPAddons uninstallation caused by insufficient input validation in the cPAddons uninstall flow. The vulnerability can lead to arbitrary script execution within the context of affected users when the uninstallation U...
CVE-2017-18417
CVE-2017-18417 affects cPanel prior to 66.0.2, where stored XSS can occur during WHM cPAddons installation. The vulnerability is tied to the cPAddons installation flow in WHM, enabling injected client-side scripts. Red Hat and CNVD entries corroborate the same issue with versions before 66.0.2. R...
CVE-2017-18403
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...
CVE-2017-18404
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...
CVE-2017-18394
cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...
CVE-2017-18397
cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
CVE-2017-18402
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...
CVE-2017-18396
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...
Design/Logic Flaw
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears SEC-299...
Remote code execution
cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...
Code injection
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...
Code injection
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...
Code injection
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...
Design/Logic Flaw
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...
CVE-2017-18416
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...
CVE-2017-18416
CVE-2017-18416 affects cPanel prior to 67.9999.103. The issue allows arbitrary file-overwrite during a Roundcube SQLite schema update (SEC-303). Connected sources confirm the vulnerability is tied to cPanel’s handling of the Roundcube SQLite schema update, enabling overwriting of arbitrary files....