CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

Code injection

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...

Code injection

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

CVE-2019-14410

CVE-2019-14410 affects cPanel prior to 78.0.2. Maketext in the Email store_filter UAPI allows a format-string injection vulnerability (SEC-472). The issue is described as a formatting string error in cPanel’s UI/automation layer, with a local attack surface and low CVSS scores reported. Affected ...

CVE-2019-14409

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...

CVE-2018-20867

cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...

CVE-2019-14403

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing SEC-483...

CVE-2019-14401

cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...

CVE-2019-14386

cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface SEC-504...

CVE-2019-14388

cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled SEC-507...

Default credentials

cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...

CVE-2019-14390

cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface SEC-512...

GoAutoDial GoAdmin CE 'cpanel' Arbitrary Command Execution Vulnerability

GoAutoDial is a set of open source Web-based call center software running on CentOS systems.GoAdmin CE is one of the set of administrator applications. A security vulnerability in the 'cpanel' function in the gosite.php script of GoAutoDial GoAdmin CE allows remote attackers to execute arbitrary...

GoAutoDial GoAdmin CE 'cpanel' action variable arbitrary command execution vulnerability

GoAutoDial is a set of open source Web-based call center software running on CentOS systems.GoAdmin CE is one of the set of administrator applications. A security vulnerability in the 'cpanel' function in the gosite.php script of GoAutoDial GoAdmin CE allows remote attackers to execute arbitrary...

cPanel 11.18.3 - List Directories and Folders Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28300/info cPanel is prone to an information-disclosure vulnerability. An attacker can exploit this issue to determine programs that are running on the affected server and to view folders on other sites that are protected...

CPanel 5-10 SUID Wrapper Remote Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20163/info cPanel is prone to a remote privilege-escalation vulnerability. A remote attacker can exploit this issue to gain administrative access to the affected application. This may lead to other attacks. !- for use old...

cPanel 5.0 Guestbook.cgi Remote Command Execution Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attack...

PT-2008-3588 · Cpanel · Cpanel

Name of the Vulnerable Software and Affected Versions: cPanel versions 11.18.0 through 11.18.3 cPanel versions 11.22.0 through 11.22.2 Description: The issue allows remote attackers to perform unauthorized actions as cPanel administrators. This can be achieved via requests to "cpanel/whm/webmail"...

cPanel 10 - 'seldir.html?dir' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21027/info cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in th...