CVE-2018-20936

The CVE-2018-20936 entry concerns cPanel prior to 68.0.27, where an attacker with local access can read the SRS secret via exim.conf (SEC-308). The vulnerability affects the exim.conf handling in cPanel and exposes the SRS secret, with CVSS indicating low severity (LOCAL, LOW impact). Remediation...

CVE-2016-10836

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...

CVE-2016-10836

CVE-2016-10836 affects cPanel prior to version 55.9999.141. The vulnerability allows arbitrary file-read operations during authentication with CalDAV. The issue is confirmed in multiple sources (NVD entry and Red Hat/CVE pages). Affected software: cPanel before 55.9999.141. Root cause: improper f...

CVE-2018-20935

CVE-2018-20935 affects cPanel before 70.0.23, enabling stored XSS via the WHM action “Reset a DNS Zone” (SEC-412). Root cause cited as insufficient validation of client-side data. Impact is stored XSS; CVSS metrics in NVD show MEDIUM/LOW levels. A fix is available in or after version 70.0.23 (see...

CVE-2018-20935

cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...

CVE-2018-20934

CVE-2018-20934 affects cPanel prior to 70.0.23, where the product fails to prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). The connected documents reiterate this description; no additional details (root cause, exact impact, affected versions beyond the pre-70....

CVE-2018-20934

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20933

CVE-2018-20933 affects cPanel before 70.0.23, with a Stored XSS via the WHM Edit DNS Zone action (SEC-410). The available connected documents confirm the vulnerable component as the WHM DNS editing workflow and identify the vulnerability class as stored cross-site scripting. No additional exploit...

CVE-2018-20933

cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...

CVE-2018-20932

CVE-2018-20932 affects cPanel before 70.0.23. The issue arises when certain domains are created, causing exposure of Apache HTTP Server logs and resulting in potential information disclosure. The primary reference is SEC-406. Exploitation status and concrete fixes are not provided in the connecte...

CVE-2018-20932

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20931

The CVE-2018-20931 issue affects cPanel prior to 70.0.23, where demo (non-privileged) accounts can execute code via the Landing Page (SEC-405). The vulnerability enables code execution through the web interface and is reflected in multiple sources (e.g., NVD, RH, CNVD). Affected product: cPanel W...

CVE-2018-20930

CVE-2018-20930 affects cPanel prior to 70.0.23, where enabling Htaccess Optimization allows bypassing .htaccess-based access restrictions. The vulnerability is caused by a flaw in the handling of htaccess rules that permits partial exposure of restricted areas without authentication. Public refer...

CVE-2018-20930

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...

CVE-2016-10837

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...

CVE-2016-10837

CVE-2016-10837 affects cPanel prior to 11.54.0.4, where an unsafe @INC path enables arbitrary code execution. The vulnerability is confirmed by multiple connected records (Red Hat, CNVD, NVD, PRION, etc.), all describing the same root cause. Impact is high (arbitrary code execution) with network ...

CVE-2016-10838

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

CVE-2016-10838

CVE-2016-10838 affects cPanel prior to 11.54.0.4, where the bin/fmq script allows arbitrary file-read operations. Root cause is a vulnerability in the bin/fmq routine enabling access to files that should be restricted. The impact is confidentiality loss (C of CVSS) with no listed impact to integr...

CVE-2018-20928

cPanel before 70.0.23 is affected by a stored XSS via the cpaddons vendor interface (SEC-391). Several sources describe this as a cross-site scripting vulnerability with client-side code execution potential due to improper validation of input data. No remediation details are provided in the docum...