4088 matches found
CVE-2017-18390
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...
CVE-2017-18387
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...
CVE-2017-18387
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...
Design/Logic Flaw
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores SEC-311...
Design/Logic Flaw
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...
Design/Logic Flaw
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...
Design/Logic Flaw
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Code injection
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...
Sql injection
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...
Sql injection
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...
Design/Logic Flaw
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records SEC-306...
Code injection
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...
Format string
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...
CVE-2017-18405
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...
CVE-2017-18405
CVE-2017-18405 affects cPanel before 68.0.15. The issue arises from the backup .htaccess modification logic (SEC-345) and enables arbitrary file-read operations. The vulnerability is locally exploitable with no user interaction required, and could lead to exposure of restricted files (confidentia...
CVE-2017-18404
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...
CVE-2017-18404
CVE-2017-18404 affects cPanel prior to 68.0.15. The vulnerability allows deletion of domain data for domains with the .lock TLD. Root cause details are not fully specified in the provided documents, but multiple sources (NVD, Red Hat, CNVD, CVE listings) corroborate the issue. There is no explici...
CVE-2017-18403
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...
CVE-2017-18403
CVE-2017-18403 affects cPanel prior to 68.0.15. The vulnerability allows code execution in the context of the nobody account via Mailman archives (SEC-337). Impact details in the provided documents indicate a potential compromise of systems running affected cPanel versions. The recommended remedi...