4117 matches found
CVE-2019-14398
Summary (CVE-2019-14398) : cPanel prior to 80.0.5 contains an input validation/command-execution vulnerability in the ajax_maketext_syntax_util.pl component (SEC-498), enabling demo accounts to execute arbitrary code. The issue is exposed over network (no user interaction required) and has a high...
CVE-2019-14397
cPanel prior to 80.0.5 is affected by CVE-2019-14397. The vulnerability allows demo accounts to modify arbitrary files through the extractfile API1 call (SEC-496). Impact is limited to unauthorized file modifications on affected systems; no broader exploitation details are provided in the sources...
CVE-2019-14397
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
CVE-2019-14396
CVE-2019-14396 affects the API Analytics adminbin in cPanel prior to version 80.0.5. The vulnerability allows spoofed insertions of log data (SEC-495). Documents consistently describe the affected component and symptom but do not provide concrete exploit details, attack vectors, or in-the-wild ac...
CVE-2019-14396
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...
CVE-2019-14395
CVE-2019-14395 affects cPanel before 80.0.5, where the Queueprocd log used world-readable permissions, enabling potential information disclosure. Root cause: improper file permissions on the log, leading to exposure of sensitive data. Remediation: upgrade to cPanel 80.0.5 or later (as per vendor ...
CVE-2019-14395
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log SEC-494...
CVE-2019-14394
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetchsslcertificatesforfqdns API SEC-489...
CVE-2019-14394
CVE-2019-14394 affects cPanel prior to 80.0.5 where the fetch_ssl_certificates_for_fqdns API can perform unsafe file operations in the context of the root account. Multiple connected sources confirm this vulnerability exists in cPanel and describes an unsafe file operation flaw exploitable locall...
CVE-2019-14393
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution SEC-486...
CVE-2019-14393
CVE-2019-14393 affects cPanel prior to version 80.0.5, where insecure cpphp execution allows local code execution in the context of a different cPanel account (SEC-486). Root cause is insecure cpphp execution. Impact is described as local code execution; exploitation status is not provided in the...
CVE-2019-14392
CVE-2019-14392 affects cPanel prior to 80.0.22, where incorrect URI dispatching enables remote code execution from a demo account (SEC-501). Impact: remote code execution with high severity; no in-wild exploit details provided in the sources. Remediation: upgrade to 80.0.22 or later. If known, ve...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...
CVE-2018-20867
CVE-2018-20867 affects cPanel prior to 76.0.8, with an open redirect when resetting connections (SEC-462). The provided documents confirm the affected product and vulnerability class; a patch is available in the 76.0.8 update (per the changelog reference). Root cause details are not provided in t...
CVE-2018-20867
cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...
CVE-2019-14389
cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...
CVE-2019-14388
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled SEC-507...
CVE-2019-14389
cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...