CVE-2019-14406

CVE-2019-14406 affects cPanel before 78.0.18, with a stored XSS in the BoxTrapper Queue Listing (SEC-493). Root cause: lack of proper validation of client-side data by the web application. Impact is consistent with stored XSS in the affected component; exploitation details are not provided in the...

CVE-2019-14405

CVE-2019-14405 affects cPanel prior to 78.0.18. The vulnerability allows demo accounts to execute code via securitypolicy.cg (SEC-487), enabling potential remote code execution with partial to high impact (per CVSS v2/v3: base scores 6.5/8.8). Affected software is cPanel; root cause details are n...

CVE-2019-14405

cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg SEC-487...

CVE-2019-14404

CVE-2019-14404 affects cPanel prior to 78.0.18, permitting certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Impact is information disclosure; no exploit details provided beyond this. Remediation: upgrade to cPanel 78.0.18 or later (p...

CVE-2019-14404

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtualuserspam router SEC-484...

CVE-2019-14403

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing SEC-483...

CVE-2019-14403

CVE-2019-14403 involves cPanel prior to 78.0.18 that allowed an open mail relay due to incorrect domain-redirect routing (SEC-483). The Red Hat advisory reiterates the issue for cPanel before 78.0.18. The CNVD entry also notes an input validation error in versions before 78.0.18. Impact is a mail...

CVE-2019-14402

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...

CVE-2019-14402

CVE-2019-14402 affects cPanel prior to 78.0.18. The root cause is unsafe terminal capability detection via infocmp, which could let an attacker infer endpoint functionality. The issue is categorized as low severity in CVSS metrics, with local access and no required user interaction. Fix: upgrade ...

CVE-2019-14401

cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...

CVE-2019-14401

CVE-2019-14401 affects cPanel prior to 78.0.18. An input validation/API path (addforward API1) can lead to code execution. Impact is described as potential remote code execution with partial/high impact per CVSS metrics. Remediation: upgrade to 78.0.18 or later (as indicated by multiple sources)....

CVE-2019-14400

CVE-2019-14400 affects cPanel prior to 78.0.18. The vulnerability arises from userdata cache misparsing (SEC-479) and allows a local attacker to escalate privileges to root. The impact is described as complete confidentiality, integrity, and availability compromise for the affected host. Remediat...

CVE-2019-14400

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing SEC-479...

CVE-2019-14399

The CVE-2019-14399 affects cPanel’s SSL certificate-storage feature prior to version 78.0.18, allowing unsafe file operations in the root context (SEC-477). The root-privilege impact is indicated by the CVSS data (high for CVSS3, medium for CVSS2). The available connected sources confirm the prod...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2019-14398

cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...

CVE-2019-14398

Summary (CVE-2019-14398) : cPanel prior to 80.0.5 contains an input validation/command-execution vulnerability in the ajax_maketext_syntax_util.pl component (SEC-498), enabling demo accounts to execute arbitrary code. The issue is exposed over network (no user interaction required) and has a high...

CVE-2019-14397

cPanel prior to 80.0.5 is affected by CVE-2019-14397. The vulnerability allows demo accounts to modify arbitrary files through the extractfile API1 call (SEC-496). Impact is limited to unauthorized file modifications on affected systems; no broader exploitation details are provided in the sources...

CVE-2019-14397

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

CVE-2019-14396

CVE-2019-14396 affects the API Analytics adminbin in cPanel prior to version 80.0.5. The vulnerability allows spoofed insertions of log data (SEC-495). Documents consistently describe the affected component and symptom but do not provide concrete exploit details, attack vectors, or in-the-wild ac...