4119 matches found
Design/Logic Flaw
cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing SEC-382...
Design/Logic Flaw
cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...
Open redirect
cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint SEC-392...
Code injection
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...
Default credentials
The chcpass script in cPanel before 11.54.0.4 reveals a password hash SEC-77...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/checksystemstorable SEC-78...
Code injection
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions SEC-79...
Default credentials
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
Design/Logic Flaw
cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
Code injection
cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication SEC-72...
Code injection
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...
Sql injection
cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...
Cross site scripting
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...
Code injection
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...
Cross site scripting
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...
Design/Logic Flaw
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...