PT-2020-10474

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows authentication bypass due to misparsing of the password file format. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-11944

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows a webmail or demo account to delete arbitrary files. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2019-20490: Undefined Security Weakness

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2020-10122: Undefined Security Weakness

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files SEC-547...

CVE-2020-10120: Undefined Security Weakness

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

PT-2020-11935

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows self XSS via a temporary character-set specification. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2020-10116: Missing Authorization

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

PT-2020-10480

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows WebDAV authentication bypass due to incorrect connection-sharing logic. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-11941

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows a demo account to achieve remote code execution via a cpsrvd rsync shell. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

PT-2020-10477

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows attackers to read an arbitrary database via MySQL dump streaming. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-11942

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows resellers to achieve remote code execution as root via a cpsrvd rsync shell. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2019-20493: Improper Neutralization of Input During Web Page Generation

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

PT-2020-10472

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue allows authentication bypass due to inconsistent processing of webmail usernames. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-10476

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue is related to the production of a predictable series of numbers by Cpanel::Rand::Get. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...

PT-2020-11937

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows for arbitrary code execution as root via dnsadmin when PowerDNS is used. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2020-10115: Undefined Security Weakness

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. SEC-537...

CVE-2020-10118: Undefined Security Weakness

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...

PT-2020-11936

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows stored self-XSS via the HTML file editor. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

CVE-2019-20498: Undefined Security Weakness

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

CVE-2019-20496: Undefined Security Weakness

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing SEC-532...