4091 matches found
CVE-2016-10790
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...
CVE-2016-10789
CVE-2016-10789 affects cPanel prior to 60.0.25. The cpsrvd 403 error response handler can be exploited to achieve code execution (SEC-191). Multiple connected sources corroborate this vulnerability entry. Impact is high if exploited; remediation is to upgrade to 60.0.25 or later (i.e., non-vulner...
CVE-2016-10789
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...
CVE-2016-10788
CVE-2016-10788 concerns cPanel prior to 60.0.25, where an arbitrary code execution vulnerability exists via Maketext in the PostgreSQL adminbin (SEC-188). The Red Hat and CVE records corroborate the same description. Affected product: cPanel; affected component: Maketext usage in PostgreSQL admin...
CVE-2016-10788
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin SEC-188...
CVE-2016-10787
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...
CVE-2016-10787
The CVE-2016-10787 entry affects cPanel’s Host Access Control feature prior to version 60.0.25, where actionless host.deny entries are mishandled (SEC-187). The vulnerability’s technical basis is the misprocessing of host.deny entries, with an external exploit path not described in the provided d...
CVE-2016-10786
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...
CVE-2016-10786
The CVE-2016-10786 entry affects cPanel before 60.0.25, where members of the nobody group can read Apache HTTP Server SSL private keys (information disclosure). Root cause is insufficient access control permitting read access to SSL keys by unauthorized system users. Red Hat and CNVD entries corr...
CVE-2016-10785
CVE-2016-10785 affects cPanel prior to 60.0.25, where an attacker could disclose file contents during file copy operations (SEC-185). Root cause described as an information disclosure vulnerability in the file-copy process. The practical impact is information disclosure of file contents; exploita...
CVE-2016-10785
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations SEC-185...
CVE-2016-10784
CVE-2016-10784 affects cPanel prior to 60.0.25, where the alias upload interface is vulnerable to self-XSS (SEC-184) due to insufficient input validation. The issue enables an attacker with access to the alias upload flow to inject and execute client-side code. The vulnerability was identified in...
CVE-2016-10784
cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...
CVE-2016-10783
cPanel before 60.0.25 allows self stored XSS in SSLlistkeys SEC-182...
CVE-2016-10783
CVE-2016-10783 affects cPanel before 60.0.25, where a self‑stored XSS is possible in SSL_listkeys due to insufficient validation in the web application. The vulnerability allows attacker‑controlled data to be stored and later reflected in the client, enabling cross‑site scripting. Affected produc...
CVE-2016-10782
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...
CVE-2016-10782
CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...
CVE-2016-10781
CVE-2016-10781 affects cPanel prior to 60.0.25, where the UI_confirm API is vulnerable to self-XSS due to insufficient validation of client-side data. The vulnerability can allow an attacker to execute client-side code via the UI_confirm interface, as described in the public records (SEC-180). Th...