764 matches found
CVE-2006-5014
Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in 1 mysqladmin and 2 hooksadmin...
cpanel10.txt
A new vulnerability was found in Cpanel V.10; It happen cause the variable &File of the select.html file in the edit-zone just filter the 's labels and the possibility can by open to other labels like Server Side Include, HMTL labels... including Javascript expressed in other ways An attacker can...
XSS in Cpanel 10
A new vulnerability was found in Cpanel V.10; It happen cause the variable &File of the select.html file in the edit-zone just filter the script's labels and the possibility can by open to other labels like Server Side Include, HMTL labels... including Javascript expressed in other ways An attack...
CVE-2004-1769
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass...
CVE-2004-1770
The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter...
CVE-2004-1604
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the private directory, which is created when Front Page extensions are enabled...
CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to 1 read arbitrary files via the backup feature or 2 chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled...
CVE-2004-2308
Cross-site scripting XSS vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html...
CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to 1 read arbitrary files via the backup feature or 2 chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled...
cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure
cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure source: https://www.securityfocus.com/bid/11456/info It is reported that cPanel is susceptible to an information disclosure vulnerability in its function to enable Front Page extensions. This vulnerability reportedly allo...
CVE-2004-0490
cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...
cPanel Remote Privilege Escalation vulnerability
Binary data 4509.prm...
CVE-2004-0529
The modified suexec program in cPanel, when configured for modphp and compiled for Apache 1.3.31 and earlier without modphpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as 1 proftpdvhosts or 2 addalink.cgi, a...
cPanel 5-9 - Passwd SQL Injection
cPanel 5-9 - Passwd SQL Injection source: https://www.securityfocus.com/bid/10505/info cPanel is reportedly affected by a remote SQL injection vulnerability in the passwd script. This issue is due to a failure of the application to properly sanitize user-supplied URI parameter input before using ...
CVE-2004-0529
The modified suexec program in cPanel, when configured for modphp and compiled for Apache 1.3.31 and earlier without modphpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as 1 proftpdvhosts or 2 addalink.cgi, a...
cPanel mod_php suEXEC Taint Vulnerability
SEVERITY: High, Arbitrary Execution as Arbitrary User PROBLEM DESCRIPTION: Flaws in how Apache's suexec binary has been patched by cPanel when configured for modphp, in conjuction with cPanel's creation of some perl scripts that are not taint clean, allow for any user to execute arbitrary code as...
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion source: https://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by...
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion
source: https://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by that administrator. This attack can allow an attacker to cause a denial...
CVE-2004-0490
cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...
cPanel 5 < 9 - Local Privilege Escalation
source: https://www.securityfocus.com/bid/10407/info cPanel is reported prone to a privilege escalation vulnerability. It is reported that the options used by cPanel to compile Apache 1.3.29 and PHP using the modphpsuexec option are insecure. These settings will reportedly permit a local attacker...