4033 matches found
CVE-2019-14413
cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
CVE-2019-14412
CVE-2019-14412 affects cPanel before 78.0.2, where the Maketext function can perform a format-string injection via the DCV domain validation via DNS UAPI (SEC-474). The underlying issue is a formatting string handling flaw in Maketext, enabling injection within the DCV check_domains_via_dns UAPI....
CVE-2019-14411
CVE-2019-14411 affects cPanel prior to 78.0.2. The vulnerability arises because the DCV UAPI does not properly restrict demo accounts from writing to files, enabling an attacker to write to files via the DCV UAPI (SEC-473). Impact is implicit in the description: unauthorized file writes by demo a...
CVE-2019-14411
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
CVE-2019-14410
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14410
CVE-2019-14410 affects cPanel prior to 78.0.2. Maketext in the Email store_filter UAPI allows a format-string injection vulnerability (SEC-472). The issue is described as a formatting string error in cPanel’s UI/automation layer, with a local attack surface and low CVSS scores reported. Affected ...
CVE-2019-14409
CVE-2019-14409 affects cPanel prior to 78.0.2. The issue allows arbitrary file-read via Passenger adminbin, causing information disclosure. Root cause: flaw in how Passenger adminbin handles file access. Impact: partial confidentiality loss with local access. Mitigation: upgrade to cPanel 78.0.2 ...
CVE-2019-14409
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2018-20867
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2018-20867
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2019-14408
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
CVE-2019-14408
CVE-2019-14408 affects cPanel before 78.0.2. Affected component: the web-based cPanel interface; root cause described as an input validation issue that allows a demo account to link with an OpenID provider (SEC-460). Consequence: sanctioned links to an OpenID provider by a non-privileged/demo acc...
Open redirect
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
Remote code execution
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2019-14407
CVE-2019-14407 affects cPanel before 78.0.2, where internal data is disclosed to OpenID providers (SEC-415). Public sources (NVD, Red Hat, CNVD) confirm that versions prior to 78.0.2 are affected and describe an information-disclosure vulnerability tied to configuration/operation errors. The prac...