Remote code execution

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

Design/Logic Flaw

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

Design/Logic Flaw

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

Authentication flaw

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

Cross site scripting

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

Design/Logic Flaw

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

Authentication flaw

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

Code injection

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...

Code injection

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. SEC-537...

Design/Logic Flaw

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...

Design/Logic Flaw

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...

Code injection

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10122

CVE-2020-10122 affects cPanel prior to 84.0.20; a webmail or demo account can delete arbitrary files (SEC-547). Connected sources confirm the issue and affected versions, but do not provide explicit remediation details in the documents. The exact fix/version beyond “before 84.0.20” is not specifi...

CVE-2020-10121

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

CVE-2020-10121

CVE-2020-10121 affects cPanel prior to 84.0.20. The description from multiple sources states that a demo account can achieve code execution via the PassengerApps APIs (SEC-546). The Red Hat, CNVD, NVD, and CVE listings corroborate the same flaw; no explicit root-cause details or exploit scripts a...

CVE-2020-10120

Summary: CVE-2020-10120 affects cPanel prior to 84.0.20 and enables remote code execution as root via the cpsrvd rsync shell. The vulnerability originates from the cpsrvd component used by cPanel, with evidenced impact to confidentiality, integrity, and availability high in CVSS terms, and requir...

CVE-2020-10120

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

CVE-2020-10119

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

CVE-2020-10119

CVE-2020-10119 affects cPanel versions before 84.0.20. The vulnerability enables remote code execution via the cpsrvd rsync shell, exploitable by a demo account (SEC-544). According to the provided data, CVSS v3.1 base score is 9.8 (CRITICAL) with network access, no authentication, and impact to ...