CVE-2016-10780

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

CVE-2016-10780

CVE-2016-10780 affects cPanel prior to 60.0.25, where the ftp_sessions API is vulnerable to stored XSS due to insufficient validation of client data. The issue allows an attacker to inject and execute client-side script through the affected API, with impact described as a stored XSS condition. Ro...

CVE-2016-10779

CVE-2016-10779 affects cPanel prior to 60.0.25, with a stored XSS in api1_listautoresponders due to insufficient input validation in the web application. The vulnerability can lead to execution of client-side code in affected sessions. Remediation: upgrade to version 60.0.25 or later (as noted in...

CVE-2016-10779

cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...

CVE-2016-10777

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

CVE-2016-10777

Summary of CVE-2016-10777 : The vulnerability affects cPanel before 60.0.25 and is described as a self‑XSS in the WHM Tweak Settings for the parameter autodiscover_host (SEC-177). The issue originates from insufficient input handling in the affected web interface, enabling an attacker to cause cl...

CVE-2016-10778

CVE-2016-10778 affects cPanel before 60.0.25, with a stored XSS in the listftpstable API (SEC-178). The root cause cited is lack of proper validation of client data, enabling attacker-controlled scripts to execute in the victim’s browser. Consequences described are client-side code execution; no ...

CVE-2016-10778

cPanel before 60.0.25 allows self stored XSS in the listftpstable API SEC-178...

CVE-2016-10776

CVE-2016-10776 affects cPanel before 60.0.25, enabling stored XSS during the homedir removal phase of WHM Account termination (SEC-174). Root cause is improper handling/validation of user-supplied data in the web interface during account termination, allowing injected scripts to be stored and pot...

CVE-2016-10776

cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination SEC-174...

CVE-2016-10796: Undefined Security Weakness

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files SEC-130...

CVE-2016-10794: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error SEC-154...

CVE-2016-10793: Improper Input Validation

cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect ! in Mail::SPF scripts SEC-152...

CVE-2016-10789: Improper Input Validation

cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...

CVE-2016-10787: Improper Input Validation

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...

CVE-2016-10786: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...

CVE-2016-10784: Improper Neutralization of Input During Web Page Generation

cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...

PT-2019-7572

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows stored XSS during the homedir removal phase of WHM Account termination. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue...

PT-2019-7573

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows self XSS in WHM Tweak Settings for autodiscover host. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue...

PT-2019-7577

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows self XSS in the UI confirm API. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue. As a temporary workaround, consider restricti...