CVE-2016-10851

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface SEC-84...

CVE-2016-10851

cPanel/WHM vulnerability CVE-2016-10851 affects cPanel before 11.54.0.4, allowing self-XSS in the WHM PHP Configuration editor (SEC-84). Root cause details aren’t specified beyond the self XSS indication. Impact is limited to the editor’s interface and user interaction, with no explicit exploitat...

CVE-2018-20918

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster SEC-372...

CVE-2018-20918

CVE-2018-20918: A stored XSS in cPanel prior to 70.0.23 affects WHM DNS Cluster. Multiple sources (NVD, Red Hat, CNVD, CVE list) reiterate that the vulnerability arises due to insufficient validation of client-side data in the web interface. Impact is contextual to web trust and session data, wit...

CVE-2016-10852

cPanel versions prior to 11.54.0.4 are affected by a lack of ACL enforcement in the AppConfig subsystem (SEC-85). Red Hat and NVD references confirm the issue, affecting cPanel’s AppConfig handling; no explicit exploit details or fix version are provided in the connected documents. The reports de...

CVE-2016-10852

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

CVE-2018-20917

cPanel before 70.0.23 allows any user to disable Solr SEC-371...

CVE-2018-20917

Affected product: cPanel prior to 70.0.23. The vulnerability (CVE-2018-20917) stems from an input validation issue and allows any user to disable Solr (SEC-371). This is documented across multiple sources (Red Hat, CNVD, NVD) with impact on availability. Exploitation details are not provided beyo...

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20916

CVE-2018-20916 affects cPanel prior to 70.0.23. The vulnerability is a Stored XSS in WHM via the Edit MX Entry, caused by lack of proper validation of client-side data in the web application. Impact stated as attacker-controlled scripts executed in the victim’s browser. Remediation: upgrade to 70...

CVE-2018-20915

CVE-2018-20915 affects cPanel before 70.0.23, allowing a stored XSS via the WHM Edit DNS Zone action (SEC-369). Affected product: cPanel/WHM DNS zone editing flow. The vulnerability is triggered by input in the DNS zone editing path and results in stored XSS; exploitation details are not provided...

CVE-2018-20915

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-369...

CVE-2016-10853

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface SEC-86...

CVE-2016-10853

Summary: CVE-2016-10853 affects cPanel before 11.54.0.4, with a stored XSS vulnerability in the WHM Feature Manager interface (SEC-86). Multiple connected sources (NVD/NVD mirror, Red Hat security page, CNVD) corroborate this description. What’s vulnerable: The WHM Feature Manager component of cP...

CVE-2018-20914

CVE-2018-20914 affects cPanel before 70.0.23. OpenID providers can inject arbitrary data into cPanel session files (SEC-368), enabling manipulation of session state and potentially impacting the confidentiality and integrity of session data. Affected versions are cPanel prior to 70.0.23. Mitigati...

CVE-2018-20914

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...

CVE-2016-10854

CVE-2016-10854 affects cPanel prior to 11.54.0.4, where the X3 Entropy Banner interface is vulnerable to a self XSS. The description is corroborated across multiple feeds (e.g., NVD and RH advisories) as a self-XSS in the X3 Entropy Banner. The available sources do not provide exploit details or ...

CVE-2016-10854

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

CVE-2018-20913

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

CVE-2018-20913

CVE-2018-20913 affects cPanel before 70.0.23. The vulnerability allows an attacker to read the root accesshash via the WHM path /cgi/trustclustermaster.cgi (SEC-364). The available sources describe the vulnerability as an information disclosure condition impacting the root accesshash, with no pub...