4087 matches found
CVE-2016-10837
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...
CVE-2016-10842
cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...
CVE-2016-10836
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...
CVE-2016-10838
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
CVE-2016-10840
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication SEC-72...
Default credentials
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
Code injection
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions SEC-79...
Code injection
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...
Design/Logic Flaw
cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing SEC-382...
Design/Logic Flaw
cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...
Default credentials
The chcpass script in cPanel before 11.54.0.4 reveals a password hash SEC-77...
Design/Logic Flaw
cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...
Open redirect
cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint SEC-392...
Design/Logic Flaw
cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...
Code injection
cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/checksystemstorable SEC-78...
Code injection
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...
Sql injection
cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...