EUVD-2004-1764

The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter...

CVE-2004-1770

CVE-2004-1770 affects the login page of cPanel 9.1.0 and possibly earlier . The issue arises from improper handling of the user parameter , allowing remote attackers to execute arbitrary code via shell metacharacters. The vulnerability is described as remote code execution with high impact (netwo...

CVE-2004-1770

The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter...

CVE-2004-1603

cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to 1 read arbitrary files via the backup feature or 2 chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled...

CVE-2004-1604

cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the private directory, which is created when Front Page extensions are enabled...

CVE-2004-1604

CVE-2004-1604 affects cPanel 9.9.1-RELEASE-3. Affected component: the Front Page extensions workflow creates a _private directory; a symlink attack allows remote authenticated users to modify permissions (chmod) on arbitrary files via that directory. Underlying cause: symlink-related path travers...

CVE-2004-1603

CVE-2004-1603 affects cPanel 9.4.1-RELEASE-64, where the application follows hard links, enabling local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file, regardless of Front Page extension status. The root cause is hard link handling in ...

CVE-2004-2308

Cross-site scripting XSS vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html...

cPanel Front Page Extension Installation Information Disclosure

Binary data 2391.prm...

cPanel Remote Backup Module Information Disclosure

Binary data 2392.prm...

[Full-Disclosure] cPanel check only the first 8 characters of webmail password

cPanel check only the first 8 characters of webmail password. HiddenBit.org Security Advisory. Date: October 21, 2004 Software: cPanel 9.4.1-STABLE 65 Author: Andrey Bayora BACKGROUND cPanel & WebHost Manager WHM is a next generation web hosting control panel system. Both cPanel & WHM are extreme...

CVE-2004-1603

cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to 1 read arbitrary files via the backup feature or 2 chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled...

[Full-Disclosure] cPanel hardlink backup issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: cPanel Vendor URL: http://www.cpanel.net Author: Karol Wisek [email protected] Date: July 19, 2004 Issue: cPanel backup feature allows logged in users to read any file, including they have not permission to read to. Description: cPanel i...

[Full-Disclosure] cPanel hardlink chown issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: cPanel Vendor URL: http://www.cpanel.net Author: Karol Wisek [email protected] Date: July 31, 2004 Issue: cPanel allows logged in users to change ownership of any file to their uid:gid. Description: cPanel is a next generation web hostin...

PT-2004-2511 · Cpanel · Cpanel

Name of the Vulnerable Software and Affected Versions: cPanel version 9.4.1-RELEASE-64 Description: The issue allows local users to read arbitrary files via the backup feature or chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. This is due to the...

cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure

cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure source: https://www.securityfocus.com/bid/11456/info It is reported that cPanel is susceptible to an information disclosure vulnerability in its function to enable Front Page extensions. This vulnerability reportedly allo...

[Full-Disclosure] cPanel symlink chmod issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: cPanel Vendor URL: http://www.cpanel.net Author: Karol Wisek [email protected] Date: September 30, 2004 Issue: cPanel allows logged in users to change permission of any file to 755. Description: cPanel is a next generation web hosting...

cPanel 9.9.1 -R3 Front Page Extension - Installation Information Disclosure

source: https://www.securityfocus.com/bid/11456/info It is reported that cPanel is susceptible to an information disclosure vulnerability in its function to enable Front Page extensions. This vulnerability reportedly allows attackers to gain access to the contents of arbitrary, potentially...

CVE-2004-1604

cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the private directory, which is created when Front Page extensions are enabled...

CVE-2004-0490

cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...