4087 matches found
CVE-2018-20943
CVE-2018-20943 affects cPanel prior to 68.0.27 and allows read access to the root user’s crontab during a short interval after a post-update task (SEC-352). This is an information disclosure vulnerability with low severity per the provided metrics; no exploitation details or fix/version remediati...
CVE-2018-20942
CVE-2018-20942 affects cPanel before 68.0.27. It enables a local attacker to read root's crontab during a short interval while configuring crontab (SEC-351). The CNVD entry describes the root cause as improper handling of concurrent access to shared resources during crontab operation, indicating ...
CVE-2018-20942
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...
CVE-2018-20941
CVE-2018-20941 affects cPanel prior to 68.0.27, enabling arbitrary file-read via the restore adminbin path (SEC-349). The vulnerability is documented across multiple aggregations (NVD, Red Hat, CNVD, CNVD-like entries). Details specify the affected product and the root cause as an arbitrary file ...
CVE-2018-20941
cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin SEC-349...
CVE-2016-10833
CVE-2016-10833 affects cPanel before 55.9999.141, where the cPHulkd username-based blocking for PRE requests is mishandled (SEC-104). The connected documents reiterate the same description without providing detailed exploit specifics, affected versions beyond the stated threshold, or concrete rem...
CVE-2016-10833
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...
CVE-2018-20940
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups SEC-342...
CVE-2018-20940
CVE-2018-20940 affects cPanel prior to 68.0.27. The (local) vulnerability allows an attacker to read the root user’s crontab file for a brief window when backups are enabled. Exploitation details are not provided in the connected documents, and there is no explicit remediation or patch informatio...
CVE-2018-20939
cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...
CVE-2018-20939
CVE-2018-20939 affects cPanel prior to 68.0.27 and causes information disclosure by enabling a user to discover contents of directories not owned by that user through backups. The root cause is an improper handling of backups that exposes directory listings, enabling partial confidentiality loss ...
CVE-2018-20938
CVE-2018-20938 affects cPanel/WHM prior to 68.0.27, where the API calls addpkgext and delpkgext do not enforce ownership during operations. This is described as an ownership enforcement defect in WHM API calls, with a CVSSv3 base score of 2.7 (LOW) and an integrity impact of LOW. The issue is lim...
CVE-2018-20938
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls SEC-324...
CVE-2016-10834
cPanel before 55.9999.141 allows account-suspension bypass via ftp SEC-105...
CVE-2016-10834
CVE-2016-10834 affects cPanel versions before 55.9999.141, where an account-suspension could be bypassed via FTP (SEC-105). Concrete details across sources confirm the vulnerability exists in cPanel and that remediation is to upgrade to 55.9999.141 or later. The Red Hat/NVD entries corroborate th...
CVE-2018-20937
cPanel before 68.0.27 does not validate database and dbuser names during renames SEC-321...
CVE-2018-20937
CVE-2018-20937 affects cPanel before 68.0.27, where database and dbuser names are not validated during rename operations (SEC-321). Multiple connected records (RH, CNVD, NVD, CVE lists) corroborate the same description. The vulnerability stems from insufficient validation in the rename process, p...
CVE-2016-10835
CVE-2016-10835 affects cPanel before version 55.9999.141 . The issue allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). The available references consistently describe bypass capability but do not provide concrete exploit vectors beyond the bypass claim, and no patch/remediation d...