CVE-2019-20494

In cPanel before 82.0.18, the RNG function Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Affected product: cPanel (web hosting control panel). Vulnerable component: Cpanel::Rand::Get. Root cause: RNG predictability leads to low-entropy sequences. Impact: potential infor...

CVE-2019-20494

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

CVE-2019-20493

CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...

CVE-2019-20492

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...

CVE-2019-20492

CVE-2019-20492 affects cPanel

CVE-2019-20490

CVE-2019-20490 affects cPanel versions prior to 82.0.18, where authentication bypass arises from inconsistent handling of Webmail usernames. The issue is confirmed across multiple sources (including Red Hat and CNVD entries) and is tied to the SEC-499 handling logic. The vulnerability enables byp...

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

PT-2020-11940

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows a demo account to modify files via Branding API calls. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2020-10121: Undefined Security Weakness

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

CVE-2020-10119: Undefined Security Weakness

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

CVE-2020-10117: Undefined Security Weakness

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

CVE-2020-10114: Improper Neutralization of Input During Web Page Generation

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10113: Improper Neutralization of Input During Web Page Generation

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20497: Improper Neutralization of Input During Web Page Generation

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration SEC-533...

CVE-2019-20495: Undefined Security Weakness

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming SEC-531...

CVE-2019-20492: Undefined Security Weakness

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...

PT-2020-11939

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue is related to the mishandling of enforcement of demo checks in the Market UAPI namespace. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the...

PT-2020-10479

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows stored XSS via WHM Backup Restoration. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-10478

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows attackers to conduct arbitrary chown operations as root during log processing. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...