Design/Logic Flaw

cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...

Code injection

cPanel before 60.0.25 allows attackers to discover file contents during file copy operations SEC-185...

Cross site scripting

cPanel before 60.0.25 allows self stored XSS in the listftpstable API SEC-178...

Cross site scripting

cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination SEC-174...

Code injection

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

CVE-2016-10797

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...

CVE-2016-10797

The vulnerability CVE-2016-10797 affects cPanel/WHM prior to 58.0.4, where the WHM uy and Install an SSL Certificate page could disclose all server domains (information disclosure). Root cause is an exposure on the SSL certificate management page (SEC-133). Impact is information exposure of dom...

CVE-2016-10796

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files SEC-130...

CVE-2016-10796

CVE-2016-10796 affects cPanel prior to 58.0.4, where Apache HTTP Server log files are created with weak permissions (SEC-130). Root cause is a permissions misconfiguration leading to potential partial information disclosure. Impact is stated as low severity with LOCAL access. The recommended reme...

CVE-2016-10795

cPanel before 59.9999.145 allows stored XSS in the WHM tailupcp2.cgi interface SEC-156...

CVE-2016-10795

The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...

CVE-2016-10794

cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error SEC-154...

CVE-2016-10794

The vulnerability CVE-2016-10794 affects cPanel prior to 59.9999.145. A multipart form processing error (SEC-154) allows arbitrary file-read operations. This is evidenced across multiple connected sources (e.g., Red Hat and CNVD entries) confirming the same issue. Affected product: cPanel web-bas...

CVE-2016-10793

CVE-2016-10793 affects cPanel prior to 59.9999.145. The root cause is an incorrect #! in Mail::SPF scripts that enables arbitrary code execution. Affected software is cPanel versions before 59.9999.145; the vulnerability allows code execution with the privilege level of the web server. Remediatio...

CVE-2016-10793

cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect ! in Mail::SPF scripts SEC-152...

CVE-2016-10792

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...

CVE-2016-10792

CVE-2016-10792 affects cPanel prior to 59.9999.145. The vulnerability allows code execution in the context of other accounts via mailman list archives (SEC-141). This is the explicit impact described in connected references. The provided documents do not specify the exact vulnerable component or ...

CVE-2016-10791

CVE-2016-10791 affects cPanel before 60.0.15. The issue arises because the product does not ensure that system accounts lack a valid password, which can render logins impossible (CPANEL-9559). Connected sources consistently describe the same flaw, with no explicit details on affected versions bey...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10790

Summary: CVE-2016-10790 affects cPanel before 60.0.25, where HTTP POSTs to listinput.cpanel.net are sent without TLS. This allows potential in-transit data exposure; CVSS metrics indicate confidentiality impact (C) and high overall risk (CVSS v3 base score 7.5). Multiple connected sources corrobo...