CVE-2018-20940

CVE-2018-20940 affects cPanel prior to 68.0.27. The (local) vulnerability allows an attacker to read the root user’s crontab file for a brief window when backups are enabled. Exploitation details are not provided in the connected documents, and there is no explicit remediation or patch informatio...

CVE-2018-20939

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20939

CVE-2018-20939 affects cPanel prior to 68.0.27 and causes information disclosure by enabling a user to discover contents of directories not owned by that user through backups. The root cause is an improper handling of backups that exposes directory listings, enabling partial confidentiality loss ...

CVE-2018-20938

CVE-2018-20938 affects cPanel/WHM prior to 68.0.27, where the API calls addpkgext and delpkgext do not enforce ownership during operations. This is described as an ownership enforcement defect in WHM API calls, with a CVSSv3 base score of 2.7 (LOW) and an integrity impact of LOW. The issue is lim...

CVE-2018-20938

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls SEC-324...

CVE-2016-10834

cPanel before 55.9999.141 allows account-suspension bypass via ftp SEC-105...

CVE-2016-10834

CVE-2016-10834 affects cPanel versions before 55.9999.141, where an account-suspension could be bypassed via FTP (SEC-105). Concrete details across sources confirm the vulnerability exists in cPanel and that remediation is to upgrade to 55.9999.141 or later. The Red Hat/NVD entries corroborate th...

CVE-2018-20937

cPanel before 68.0.27 does not validate database and dbuser names during renames SEC-321...

CVE-2018-20937

CVE-2018-20937 affects cPanel before 68.0.27, where database and dbuser names are not validated during rename operations (SEC-321). Multiple connected records (RH, CNVD, NVD, CVE lists) corroborate the same description. The vulnerability stems from insufficient validation in the rename process, p...

CVE-2016-10835

CVE-2016-10835 affects cPanel before version 55.9999.141 . The issue allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). The available references consistently describe bypass capability but do not provide concrete exploit vectors beyond the bypass claim, and no patch/remediation d...

CVE-2016-10835

cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging SEC-107...

CVE-2018-20936

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf SEC-308...

CVE-2018-20936

The CVE-2018-20936 entry concerns cPanel prior to 68.0.27, where an attacker with local access can read the SRS secret via exim.conf (SEC-308). The vulnerability affects the exim.conf handling in cPanel and exposes the SRS secret, with CVSS indicating low severity (LOCAL, LOW impact). Remediation...

CVE-2016-10836

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...

CVE-2016-10836

CVE-2016-10836 affects cPanel prior to version 55.9999.141. The vulnerability allows arbitrary file-read operations during authentication with CalDAV. The issue is confirmed in multiple sources (NVD entry and Red Hat/CVE pages). Affected software: cPanel before 55.9999.141. Root cause: improper f...

CVE-2018-20935

cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...

CVE-2018-20935

CVE-2018-20935 affects cPanel before 70.0.23, enabling stored XSS via the WHM action “Reset a DNS Zone” (SEC-412). Root cause cited as insufficient validation of client-side data. Impact is stored XSS; CVSS metrics in NVD show MEDIUM/LOW levels. A fix is available in or after version 70.0.23 (see...

CVE-2018-20934

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20934

CVE-2018-20934 affects cPanel prior to 70.0.23, where the product fails to prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). The connected documents reiterate this description; no additional details (root cause, exact impact, affected versions beyond the pre-70....

CVE-2018-20933

CVE-2018-20933 affects cPanel before 70.0.23, with a Stored XSS via the WHM Edit DNS Zone action (SEC-410). The available connected documents confirm the vulnerable component as the WHM DNS editing workflow and identify the vulnerability class as stored cross-site scripting. No additional exploit...