CVE-2016-10773

CVE-2016-10773 affects cPanel prior to 60.0.25, where a format-string injection bug exists in how exception messages are handled (SEC-171). The NVD lists CVSSv3 base score 8.8 (HIGH) and CVSSv2 6.5 (MEDIUM) with network access and low attack complexity, indicating potential remote impact without ...

CVE-2016-10772

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin SEC-168...

CVE-2016-10772

CVEs surrounding cPanel 2016-10772 : The vulnerability affects cPanel before 60.0.25, where the system does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). Multiple connected sources (Red Hat CVE entry, CNVD-2019-29623, NVD entry) reiterate the same descriptio...

CVE-2016-10771

CVE-2016-10771 affects cPanel before 60.0.25, allowing file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). The issue resides in the ModSecurity audit logfile processing path, enabling unauthorized changes to filesystem state. Multiple connected sources cor...

CVE-2016-10771

cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing SEC-165...

CVE-2016-10770

CVE-2016-10770 affects cPanel prior to 60.0.25. The vulnerability allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). The provided documents consistently describe this as a cPanel issue related to the update process, with no additional technical details (e.g., affected...

CVE-2016-10770

cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update SEC-164...

CVE-2016-10769

cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi SEC-162...

CVE-2016-10769

CVE-2016-10769 affects cPanel before 60.0.25; it enables an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). No exploitation details are provided in the connected docs beyond this, and the vulnerability is characterized as an open redirect. Remediation per the available references is to u...

CVE-2016-10768

cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades SEC-161...

CVE-2016-10768

CVE-2016-10768 affects cPanel prior to 60.0.25, where during preparation for MySQL upgrades a file-overwrite operation is possible (SEC-161). Vulnerable component: cPanel software; impact described as potential file overwrites during upgrade prep. Remediation: upgrade to cPanel 60.0.25 or later. ...

CVE-2016-10767

CVE-2016-10767 affects cPanel before 60.0.25, allowing stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). The vulnerability stems from improper input validation of client data, enabling stored script execution. Remediation: upgrade to cPanel 60.0.25 or later (apply the security...

CVE-2016-10767

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

CVE-2017-18482

CVE-2017-18482 affects cPanel before 62.0.4; the issue arises from resellers using the WHM enqueue_transfer_item API to queue non-rearrange modules (SEC-213). Root cause: exposed API misuse in WHM allowing unauthorized queueing actions. Impact: potential partial availability impact per CVSS v3 sc...

CVE-2017-18482

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...

CVE-2017-18481

CVE-2017-18481 affects cPanel (specifically the WHM Account Suspension List interface) prior to version 62.0.4. The issue is a stored XSS vulnerability caused by insufficient input validation in the web interface, allowing attacker-supplied script to be stored and potentially executed in victims’...

CVE-2017-18481

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...

CVE-2017-18480

CVE-2017-18480 affects cPanel/WHM: prior to 62.0.4, has_mycnf_for_cpuser API calls do not enforce account ownership, per SEC-210. Root cause is missing ownership checks in those WHM API calls. Impact as stated: potential exposure of sensitive configuration data via API calls; CVSS v3 vector indic...

CVE-2017-18480

cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...

CVE-2017-18479

CVE-2017-18479 affects cPanel prior to 62.0.4, where WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). The issue is documented with CVSS metrics (CVSSv2 base 4.0, MEDIUM; CVSSv3 base 6.5, MEDIUM). Affected component: WHM/cPanel SSL certificate generation process; root ca...