Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel software. The problem affects all currently supported versions of cPanel and WebHost Manager WHM, according to an alert...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2016-10810

In cPanel before 57.9999.54, /scripts/maildirconverter exposed a TTY to an unprivileged process SEC-115...

CVE-2016-10838

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

CVE-2016-10856

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

CVE-2016-10775

cPanel before 60.0.25 allows arbitrary file-chown operations via reassignpostterminatecruft SEC-173...

CVE-2016-10829

cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error SEC-99...

CVE-2016-10784

cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...

CVE-2016-10847

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...

CVE-2016-10830

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magicrevision SEC-100...

CVE-2016-10803

cPanel before 57.9999.105 allows newline injection via LOC records CPANEL-6923...

CVE-2016-10834

cPanel before 55.9999.141 allows account-suspension bypass via ftp SEC-105...

CVE-2016-10852

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

CVE-2016-10780

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

CVE-2016-10816

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...

CVE-2016-10825

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents SEC-92...

CVE-2016-10843

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...

CVE-2016-10807

cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost SEC-112...

CVE-2016-10788

cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...

CVE-2016-10779

cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...