CVE-2016-10777

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

Cross site scripting

cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination SEC-174...

CVE-2016-10797

The vulnerability CVE-2016-10797 affects cPanel/WHM prior to 58.0.4, where the WHM uy and Install an SSL Certificate page could disclose all server domains (information disclosure). Root cause is an exposure on the SSL certificate management page (SEC-133). Impact is information exposure of dom...

CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10777

Summary of CVE-2016-10777 : The vulnerability affects cPanel before 60.0.25 and is described as a self‑XSS in the WHM Tweak Settings for the parameter autodiscover_host (SEC-177). The issue originates from insufficient input handling in the affected web interface, enabling an attacker to cause cl...

CVE-2016-10776

CVE-2016-10776 affects cPanel before 60.0.25, enabling stored XSS during the homedir removal phase of WHM Account termination (SEC-174). Root cause is improper handling/validation of user-supplied data in the web interface during account termination, allowing injected scripts to be stored and pot...

CVE-2017-18479

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address SEC-209...

CVE-2017-18480

cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...

CVE-2017-18481

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...

CVE-2017-18482

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...

CVE-2016-10767

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

CVE-2016-10767

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

Code injection

cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...

Design/Logic Flaw

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...

Design/Logic Flaw

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...

Design/Logic Flaw

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address SEC-209...

Cross site scripting

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

CVE-2016-10767

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

CVE-2017-18482

CVE-2017-18482 affects cPanel before 62.0.4; the issue arises from resellers using the WHM enqueue_transfer_item API to queue non-rearrange modules (SEC-213). Root cause: exposed API misuse in WHM allowing unauthorized queueing actions. Impact: potential partial availability impact per CVSS v3 sc...