Code injection

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...

Design/Logic Flaw

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration SEC-533...

Remote code execution

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

Authentication flaw

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

Code injection

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

Design/Logic Flaw

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

Cross site scripting

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

Design/Logic Flaw

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

Authentication flaw

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Design/Logic Flaw

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...

Design/Logic Flaw

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...

Code injection

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming SEC-531...

Code injection

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. SEC-537...

Design/Logic Flaw

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

Design/Logic Flaw

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

Remote code execution

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

CVE-2020-10122

CVE-2020-10122 affects cPanel prior to 84.0.20; a webmail or demo account can delete arbitrary files (SEC-547). Connected sources confirm the issue and affected versions, but do not provide explicit remediation details in the documents. The exact fix/version beyond “before 84.0.20” is not specifi...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10121

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

CVE-2020-10121

CVE-2020-10121 affects cPanel prior to 84.0.20. The description from multiple sources states that a demo account can achieve code execution via the PassengerApps APIs (SEC-546). The Red Hat, CNVD, NVD, and CVE listings corroborate the same flaw; no explicit root-cause details or exploit scripts a...