CVE-2020-26103

CVE-2020-26103 affects cPanel prior to 88.0.3, where an insecure site password is used for Mailman on a templated VM. Root cause is insecure credential handling for Mailman. Impact is limited to exposure/ misuse of the Mailman credential as described in the vulnerability, with no additional explo...

CVE-2020-26103

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM SEC-551...

CVE-2020-26104

In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM SEC-552...

CVE-2020-26104

CVE-2020-26104 affects cPanel prior to 88.0.3, where an insecure SRS secret is used on a templated VM (SEC-552). The connected sources (NVD, Red Hat, CNVD, CVE lists) consistently describe this weakness as an insecure SRS secret in templated VM usage, with no additional technical details provided...

CVE-2020-26105

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). The vulnerability affects cPanel releases prior to 88.0.3 involving chkservd credential handling on templated VMs. Root cause is insecure test credentials being used in the chkservd process; explicit...

CVE-2020-26105

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM SEC-554...

CVE-2020-26106

cPanel before 88.0.3 has weak permissions world readable for the proxy subdomains log file SEC-558...

CVE-2020-26106

CVE-2020-26106 affects cPanel before 88.0.3, where the proxy subdomains log file has weak permissions (world-readable). Root cause: insecure file permissions on the log file (SEC-558). Potential impact (per CNVD): privilege elevation. Confirmed sources include Red Hat and CNVD entries; NVD/NVD-ba...

CVE-2020-26107

Summary: CVE-2020-26107 affects cPanel prior to 88.0.3, where an upgrade establishes predictable PowerDNS API keys, per multiple connected sources. Affected software: cPanel versions before 88.0.3. Root cause / vulnerability detail: During upgrade, the process creates predictable API keys for Pow...

CVE-2020-26107

cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys SEC-561...

CVE-2020-26108

CVE-2020-26108 affects cPanel prior to 88.0.13, where mis‑dispatching of file extensions can lead to code execution (SEC-488). The issue is described consistently across sources as a vulnerability in how cPanel handles certain file‑extension dispatching, enabling unintended code execution with th...

CVE-2020-26108

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution SEC-488...

CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

CVE-2020-26109

CVE-2020-26109 affects cPanel prior to version 88.0.13, where a protection mechanism intended to restrict package modification can be bypassed (SEC-557). The public documents consistently describe a bypass vulnerability enabling modification of packages despite the protection. Affected product: c...

CVE-2020-26110

CVE-2020-26110 affects cPanel before 88.0.13. The issue is a self XSS vulnerability exposed via the DNS Zone Manager DNSSEC interfaces (SEC-564); likely related to input handling in the DNSSEC UI. Impact is user-level script execution within the vulnerable web interface; no exploitation details a...

CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...

CVE-2020-26111

CVE-2020-26111 affects cPanel prior to 90.0.10. The vulnerability is a self XSS in the WHM Edit DNS Zone interface (SEC-566). Impact described as partial integrity risk with low confidentiality/low integrity and no availability impact in CVSS 3.1 (base score 6.1; UI required; network vector; chan...

CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...

CVE-2020-26112

The email quota cache in cPanel before 90.0.10 allows overwriting of files...

CVE-2020-26112

CVE-2020-26112 affects cPanel up to version 90.0.10, where the email quota cache can overwrite files. This is a vulnerability in the email quota cache component of cPanel before 90.0.10. Impact: potential unauthorized file overwrites within the affected systems. Remediation: upgrade to cPanel 90....