4119 matches found
Design/Logic Flaw
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...
Code injection
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...
Authentication flaw
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...
CVE-2018-20946
cPanel before 68.0.27 exposes zone information because the archive_sync_zones script creates a world‑readable archive. This info disclosure vulnerability is documented across CVE‑2018‑20946 entries (NVD, RH, CNVD, etc.). Impact is information exposure of zones; CVSS v3 score is Low (3.3) with loc...
CVE-2018-20946
cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...
CVE-2018-20945
bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...
CVE-2018-20945
The CVE-2018-20945 issue affects cPanel prior to 68.0.27 (bin/csvprocess) and enables insecure file operations due to SEC-354. Affected product: cPanel / web hosting control panel. Root cause details are consistently described across connected records as insecure file handling in bin/csvprocess b...
CVE-2018-20944
CVE-2018-20944 affects cPanel before 68.0.27, where an attacker can read a copy of httpd.conf that is created during a syntax test (SEC-353). The underlying issue is an information-disclosure vector within the syntax-test workflow.
CVE-2018-20944
cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test SEC-353...
CVE-2016-10832
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging SEC-102...
CVE-2016-10832
CVE-2016-10832 affects cPanel prior to 55.9999.141. The vulnerability is an FTP cPHulk bypass via account name munging (SEC-102), enabling bypass of FTP authentication checks. Root cause: improper handling during the cPHulk workflow allows bypass when munging the account name. Impact: potential u...
CVE-2018-20943
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task SEC-352...
CVE-2018-20943
CVE-2018-20943 affects cPanel prior to 68.0.27 and allows read access to the root user’s crontab during a short interval after a post-update task (SEC-352). This is an information disclosure vulnerability with low severity per the provided metrics; no exploitation details or fix/version remediati...
CVE-2018-20942
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...
CVE-2018-20942
CVE-2018-20942 affects cPanel before 68.0.27. It enables a local attacker to read root's crontab during a short interval while configuring crontab (SEC-351). The CNVD entry describes the root cause as improper handling of concurrent access to shared resources during crontab operation, indicating ...
CVE-2018-20941
CVE-2018-20941 affects cPanel prior to 68.0.27, enabling arbitrary file-read via the restore adminbin path (SEC-349). The vulnerability is documented across multiple aggregations (NVD, Red Hat, CNVD, CNVD-like entries). Details specify the affected product and the root cause as an arbitrary file ...
CVE-2018-20941
cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin SEC-349...
CVE-2016-10833
CVE-2016-10833 affects cPanel before 55.9999.141, where the cPHulkd username-based blocking for PRE requests is mishandled (SEC-104). The connected documents reiterate the same description without providing detailed exploit specifics, affected versions beyond the stated threshold, or concrete rem...