CVE-2019-20496

Summary: CVE-2019-20496 affects cPanel prior to 82.0.18, where log processing can trigger arbitrary chown operations as root. Affected software: cPanel (prior to 82.0.18). Root cause / impact: An unauthorized chown operation is possible during log processing, granting root-level ownership changes...

CVE-2019-20496

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...

CVE-2019-20495

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming SEC-531...

CVE-2019-20495

CVE-2019-20495 affects cPanel; prior to version 82.0.18, an attacker can read an arbitrary database via a MySQL dump stream. Impact is partial confidentiality breach (read access). Remediation: upgrade to 82.0.18 or newer. Exploitation status not provided in the documents.

CVE-2019-20494

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

CVE-2019-20494

In cPanel before 82.0.18, the RNG function Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Affected product: cPanel (web hosting control panel). Vulnerable component: Cpanel::Rand::Get. Root cause: RNG predictability leads to low-entropy sequences. Impact: potential infor...

CVE-2019-20493

CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...

CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

CVE-2019-20492

CVE-2019-20492 affects cPanel

CVE-2019-20492

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2019-20490

CVE-2019-20490 affects cPanel versions prior to 82.0.18, where authentication bypass arises from inconsistent handling of Webmail usernames. The issue is confirmed across multiple sources (including Red Hat and CNVD entries) and is tied to the SEC-499 handling logic. The vulnerability enables byp...

CVE-2019-20491

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions SEC-508...

CVE-2019-20491

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions SEC-508...

Design/Logic Flaw

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions SEC-508...

CVE-2019-20491

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions SEC-508...

CVE-2019-20491

CVE-2019-20491 concerns cPanel prior to 82.0.18 where an attacker can leverage virtual mail accounts to bypass account suspensions (SEC-508). This is the explicit vulnerability described in multiple sources. The linked Red Hat/CNVD/etc. entries corroborate the same issue. Impact is that a bypass ...

CVE-2012-6449

The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 build 8 have a XSS vulnerability...

Design/Logic Flaw

The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 build 8 have a XSS vulnerability...

CVE-2012-6449

CVE-2012-6449 affects cPanel & WHM 11.34.0 (build 8); the vulnerable components are clientconf.html and detailbw.html, with a documented cross-site scripting (XSS) vulnerability. NVD CVSSv3.1 base score 5.4 (MEDIUM) via NETWORK/vector: LOW spoofed user interaction required? The data shows UI inte...