4118 matches found
Design/Logic Flaw
cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...
Design/Logic Flaw
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...
Code injection
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution SEC-486...
Design/Logic Flaw
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...
Design/Logic Flaw
cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...
Design/Logic Flaw
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
CVE-2018-20870
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...
CVE-2018-20870
CVE-2018-20870 affects the WebDAV transport feature in cPanel versions before 76.0.8 . The vulnerability is that debug logging is enabled by this feature (SEC-467). The connected documents consistently echo this description but do not provide explicit exploit details, impacted products beyond the...
CVE-2018-20869
CVE-2018-20869 affects cPanel before 76.0.8, where arbitrary code execution is possible in the root context via dnssec adminbin (SEC-465). Multiple sources (NVD/Red Hat/CNVD/CVE lists) confirm the flaw allowing local escalation with high impact (C/H/I/A). Affected product is cPanel; vulnerable co...
CVE-2018-20869
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...
CVE-2018-20862
The CVE-2018-20862 issue affects cPanel prior to 76.0.8, where PostgreSQL password changes are performed unsafely (SEC-366). Affected: cPanel’s password-change workflow for PostgreSQL. Impact: potential improper handling of password changes; CVSS indicates high impact (confidentiality, integrity,...
CVE-2018-20862
cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...
CVE-2018-20868
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...
CVE-2018-20868
cPanel before 76.0.8 contains a Stored XSS in the WHM MultiPHP Manager interface (SEC-464). Affected product: cPanel/WHM (MultiPHP Manager); vulnerable component: stored XSS in the interface. Root cause: vulnerability described as Stored XSS; the exact exploit details are not provided in the docu...
CVE-2018-20866
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...
CVE-2018-20866
CVE-2018-20866 affects cPanel before 76.0.8, with a Stored XSS in the WHM “Reset a DNS Zone” feature (SEC-461). The vulnerability concerns the handling of input in Reset DNS Zone, enabling stored cross-site scripting. Documents consistently describe the issue as a stored XSS vulnerability in that...
CVE-2018-20865
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
CVE-2018-20865
CVE-2018-20865 affects cPanel prior to 76.0.8, where a Self XSS flaw exists in the WHM Addtional Backup Destination field (SEC-459). Exploitation context is not detailed in the provided documents, but the vulnerability is tied to user-supplied content in the WHM backup destination setting, enabli...
CVE-2018-20864
CVE-2018-20864 affects cPanel before 76.0.8. The vulnerability allows a persistent Virtual FTP account after removal of its associated domain (SEC-454). Public details in connected sources describe the affected product and the outcome, but do not provide explicit root-cause analysis or remediatio...