4088 matches found
Code injection
cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...
Design/Logic Flaw
cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...
Command injection
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list SEC-75...
Design/Logic Flaw
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...
Design/Logic Flaw
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...
Authentication flaw
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...
Design/Logic Flaw
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...
Sql injection
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file SEC-123...
Design/Logic Flaw
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...
Cross site scripting
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...
CVE-2016-10813
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...
CVE-2016-10813
CVE-2016-10813 affects cPanel prior to 57.9999.54, where an input handling flaw during FTP account creation under addon domains allows self-XSS. Root cause: insufficient input validation in the addon domains FTP creation flow. Impact: client-side script execution under the victim’s browser; no se...
CVE-2016-10814
cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...
CVE-2016-10814
cPanel before 57.9999.54 is vulnerable to a demo-mode escape via show_template.stor (SEC-119). Affected product: cPanel; issue arises in versions prior to 57.9999.54. The connected documents do not provide further exploit details. Remediation: upgrade to 57.9999.54 or later.
CVE-2016-10815
CVE-2016-10815 affects cPanel prior to 57.9999.54, enabling arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). The vulnerability stems from insufficient access controls in the Branding APIs, allowing an attacker to read files on behalf of Webmail users. No exploitati...
CVE-2016-10815
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...
CVE-2016-10816
CVE-2016-10816 affects cPanel prior to 57.9999.54, where Webmail accounts can execute arbitrary code via forwarders. Public sources confirm the issue exists in these versions; Red Hat, CNVD, and CVE listings corroborate the vulnerability description. The root cause and affected scope are tied to ...
CVE-2016-10816
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...
CVE-2016-10817
CVE-2016-10817 affects cPanel prior to version 57.9999.54, where a SQL injection is possible via the ModSecurity TailWatch log file (SEC-123). Affected software is explicitly stated as cPanel; root cause is unvalidated SQL operations exposed through TailWatch. Impact is defined as high/critical i...