4087 matches found
Code injection
cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...
Design/Logic Flaw
cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...
Design/Logic Flaw
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...
Code injection
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...
Code injection
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...
Authentication flaw
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...
Cross site scripting
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...
Cross site scripting
cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface SEC-391...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck SEC-81...
Cross site scripting
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...
CVE-2018-20946
cPanel before 68.0.27 exposes zone information because the archive_sync_zones script creates a world‑readable archive. This info disclosure vulnerability is documented across CVE‑2018‑20946 entries (NVD, RH, CNVD, etc.). Impact is information exposure of zones; CVSS v3 score is Low (3.3) with loc...
CVE-2018-20946
cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...
CVE-2018-20945
bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...
CVE-2018-20945
The CVE-2018-20945 issue affects cPanel prior to 68.0.27 (bin/csvprocess) and enables insecure file operations due to SEC-354. Affected product: cPanel / web hosting control panel. Root cause details are consistently described across connected records as insecure file handling in bin/csvprocess b...
CVE-2018-20944
cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test SEC-353...
CVE-2018-20944
CVE-2018-20944 affects cPanel before 68.0.27, where an attacker can read a copy of httpd.conf that is created during a syntax test (SEC-353). The underlying issue is an information-disclosure vector within the syntax-test workflow.
CVE-2016-10832
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging SEC-102...
CVE-2016-10832
CVE-2016-10832 affects cPanel prior to 55.9999.141. The vulnerability is an FTP cPHulk bypass via account name munging (SEC-102), enabling bypass of FTP authentication checks. Root cause: improper handling during the cPHulk workflow allows bypass when munging the account name. Impact: potential u...