CVE-2020-10120

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

CVE-2020-10120

Summary: CVE-2020-10120 affects cPanel prior to 84.0.20 and enables remote code execution as root via the cpsrvd rsync shell. The vulnerability originates from the cpsrvd component used by cPanel, with evidenced impact to confidentiality, integrity, and availability high in CVSS terms, and requir...

CVE-2020-10119

CVE-2020-10119 affects cPanel versions before 84.0.20. The vulnerability enables remote code execution via the cpsrvd rsync shell, exploitable by a demo account (SEC-544). According to the provided data, CVSS v3.1 base score is 9.8 (CRITICAL) with network access, no authentication, and impact to ...

CVE-2020-10119

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

CVE-2020-10118

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...

CVE-2020-10118

CVE-2020-10118 affects cPanel before 84.0.20 via the Branding API, where a demo account can modify files. The Red Hat/CNVD entries corroborate the same issue (file modification via Branding API). The vulnerability is tied to cPanel’s Branding API handling, enabling unauthorized file changes with ...

CVE-2020-10117

CVE-2020-10117 affects cPanel prior to 84.0.20, where enforcement of demo checks in the Market UAPI namespace is mishandled (SEC-542). The issue enables weaknesses in access/validation that could impact confidentiality and integrity (per CVSS3.1: High, with Network access and no user interaction)...

CVE-2020-10117

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

CVE-2020-10116

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

CVE-2020-10116

CVE-2020-10116 affects cPanel prior to 84.0.20. An attacker can bypass restrictions on features and demo accounts via WebDisk UAPI calls, enabling a restriction-bypass condition (SEC-541). The issue is tied to versions before 84.0.20; upgrade to 84.0.20 or later to remediate.

CVE-2020-10115

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. SEC-537...

CVE-2020-10115

CVE-2020-10115 affects cPanel before 84.0.20 when PowerDNS is used, enabling arbitrary code execution as root via the dnsadmin account. This vulnerability is corroborated across multiple sources (NVD, Red Hat, CNVD, CVE list) with the same core impact and affected condition. The root cause is imp...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

CVE-2020-10114 affects cPanel prior to 84.0.20. The vulnerability is described as a stored self‑XSS via the HTML file editor (SEC-535). The connected documents do not provide additional technical details such as affected components beyond the editor, exploit vectors, or concrete remediation steps...

CVE-2020-10113

CVE-2020-10113 affects cPanel prior to 84.0.20. The issue is a self-XSS via a temporary character-set specification (SEC-515). Multiple connected sources (Red Hat, CNVD) confirm the same description, with CNVD explicitly noting versions prior to 84.0.20. The impact is limited to client-side execu...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20498

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

CVE-2019-20498

CVE-2019-20498 affects cPanel prior to 82.0.18. The issue is a WebDAV authentication bypass caused by incorrect connection-sharing logic (SEC-534). Reported across multiple feeds, the vulnerability explicitly impacts WebDAV authentication. Affected component: cPanel WebDAV handling; root cause: f...

CVE-2019-20497

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration SEC-533...

CVE-2019-20497

The CVE-2019-20497 vulnerability affects cPanel prior to version 82.0.18, allowing stored XSS via the WHM Backup Restoration feature. Root cause details are not further described in the provided documents beyond the XSS via backup restore path. No exploit specifics, mitigations, or confirmed patc...