1928 matches found
CVE-2017-18411
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...
CVE-2017-18410
CVE-2017-18410 affects cPanel before 67.9999.103, where a user account’s backup archive could contain all MySQL databases on the server, exposing sensitive data. The vulnerability is disclosed across multiple sources (NVD, Red Hat, CNVD, CVE lists). Root cause details are not provided beyond the ...
CVE-2017-18389
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...
CVE-2017-18386
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...
Design/Logic Flaw
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...
Design/Logic Flaw
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Sql injection
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...
Format string
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...
CVE-2017-18405
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...
CVE-2017-18402
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...
CVE-2017-18398
The CVE-2017-18398 entry refers to cPanel's DnsUtils prior to version 68.0.15, where zone creation is possible for hostname and account subdomains (SEC-331). This is documented across multiple connected sources (RH/CVE, NVD, CNVD/CNVD-2019-36129) indicating a vulnerability in the DNS management u...
CVE-2017-18398
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...
CVE-2017-18397
cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...
CVE-2017-18396
The CVE-2017-18396 issue affects cPanel before 68.0.15, where Exim vdomainaliases enables arbitrary file-read operations. Root cause: improper handling in vdomainaliases leads to access to restricted files. Impact: potential disclosure of sensitive data on affected systems. Evidence from Red Hat ...
CVE-2017-18395
CVE-2017-18395 affects cPanel before 68.0.15, where the system does not block a username of ssl (SEC-328). This is corroborated by Red Hat and other records in the connected data. Public details describe the issue but do not provide a patch or remediation steps within the supplied documents. CVSS...
CVE-2017-18394
CVE-2017-18394 affects cPanel prior to 68.0.15, where the reserved usernames list is insufficient (SEC-327). The Red Hat entry repeats the same description. No further technical details (vulnerable component, exploit specifics, affected products beyond cPanel, or concrete remediation/patch versio...
CVE-2017-18392
CVE-2017-18392 affects cPanel prior to 68.0.15; the issue allows collisions because PostgreSQL databases can be assigned to multiple accounts (root cause described in multiple sources). Reported across NVD/Red Hat/CNVD databases with CVSS 3.0/2.0 scores (LOW). Concrete remediation steps are not p...
CVE-2017-18392
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...