4088 matches found
Design/Logic Flaw
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM SEC-554...
Code injection
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM SEC-550...
Design/Logic Flaw
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM SEC-551...
Authentication flaw
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism SEC-491...
Design/Logic Flaw
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...
Design/Logic Flaw
cPanel before 90.0.10 allows self XSS via the Cron Editor interface SEC-574...
Code injection
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys SEC-561...
Design/Logic Flaw
cPanel before 88.0.3 has weak permissions world readable for the proxy subdomains log file SEC-558...
Code injection
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM SEC-552...
CVE-2020-26098
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution SEC-485...
EUVD-2020-18728
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution SEC-485...
CVE-2020-26098
CVE-2020-26098 affects cPanel prior to 88.0.3, where improper handling of the Exim filter path enables remote code execution (SEC-485). The issue is confirmed across multiple connected sources (RH CVE, CNVD, NVD, CVE listing, EUVD, PRION) and is characterized by a high/critical impact vector with...
CVE-2020-26099
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism SEC-491...
CVE-2020-26099
CVE-2020-26099 affects cPanel prior to 88.0.3, where the SMTP greylisting protection (SEC-491) can be bypassed. Root cause details are not broken out beyond the vendor-reported bypass of the greylisting mechanism. The vulnerability enables an attacker to bypass SMTP greylisting, as described in t...
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape SEC-497...
CVE-2020-26100
CVE-2020-26100 affects cPanel prior to 88.0.3, where the chsh component enables a Jailshell escape (SEC-497). The description across sources confirms the issue and version boundary, but detailed exploit steps or exploitability are not provided in the supplied documents. A patch is indicated by up...
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM SEC-549...
CVE-2020-26101
The CVE-2020-26101 affects cPanel prior to 88.0.3, where insecure RNDC credentials are used for BIND on a templated VM (SEC-549). The issue is documented across multiple sources (NVD entry for CVE-2020-26101 and related CNVD/CVE records). Affected software: cPanel
CVE-2020-26102
CVE-2020-26102 affects cPanel before 88.0.3 where Dovecot on a templated VM uses an insecure auth policy API key (SEC-550). The vulnerability is evidenced by public records showing a policy-key weakness in the Dovecot integration within cPanel’s VM templating. Public CVSS metrics indicate medium ...