4088 matches found
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...
Code injection
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...
Design/Logic Flaw
In cPanel before 66.0.2, domain log files become readable after log processing SEC-273...
CVE-2017-18438
CVE-2017-18438 affects cPanel prior to 64.0.21. The issue allows a demo account to execute code through Encoding API calls (SEC-242), enabling code execution with what is described as low privilege, network-remote access. The provided connected documents confirm the vulnerability exists in the cP...
CVE-2017-18438
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...
CVE-2017-18437
CVE-2017-18437 affects cPanel prior to 64.0.21, where a Webmail account can execute code via forwarders (SEC-240). Impact is code execution with Webmail privileges; CVSS data shows LOW to MEDIUM base scores (C/L/I/P). Remediation: upgrade to 64.0.21 or newer to fix the vulnerability. Other detail...
CVE-2017-18437
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...
CVE-2017-18436
The CVE-2017-18436 issue affects cPanel prior to 64.0.21, where demo accounts can read files via the Fileman::getfileactions API2 call (SEC-239). Root cause: insufficient access control in the Fileman API allowing read access to files. Impact: potential partial disclosure of file contents for dem...
CVE-2017-18436
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...
CVE-2017-18435
This CVE affects cPanel before 64.0.21, where demo accounts could cause code execution via the BoxTrapper API (SEC-238). The issue is tied to the BoxTrapper API and is documented as exploitable by non-privileged, unauthenticated users, enabling remote code execution with low attacker effort. The ...
CVE-2017-18435
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...
CVE-2017-18434
CVE-2017-18434 affects cPanel prior to 64.0.21. The vulnerability allows code execution in the root account context via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). The provided connected Red Hat/CNVD/EUVD/PRION/CVE records corroborate the same core issue and describe the root caus...
CVE-2017-18434
cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...
CVE-2017-18433
CVE-2017-18433 affects cPanel prior to version 64.0.21. The vulnerability allows code execution via the store_filter API call initiated by webmail and demo accounts (SEC-236). Multiple sources (Red Hat, CNVD, NVD, CVE registry) corroborate that the flaw exists in older cPanel builds; no public ex...
CVE-2017-18433
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...
CVE-2017-18432
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password SEC-234...
CVE-2017-18432
CVE-2017-18432 affects cPanel prior to 64.0.21, specifically the Horde MySQL to SQLite conversion process. The underlying issue is a leakage of a database password (SEC-234) during the conversion, enabling potential disclosure of database credentials. This vulnerability has a high impact on confi...
CVE-2017-18431
CVE-2017-18431 affects cPanel prior to 66.0.1 and relates to unreliable suspend/unsuspend operations on accounts (CPANEL-13941). Multiple sources (NVD entry and Red Hat advisory) document the issue with a CVSS v3 base score of 7.5 (HIGH) and an integrity impact described as HIGH, while attack vec...