4117 matches found
CVE-2019-14388
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled SEC-507...
CVE-2019-14387
CVE-2019-14387 affects cPanel before 82.0.2, with a Self XSS vulnerability in the cPanel and webmail master templates (SEC-506). Root cause is client-side script execution via crafted input in template code. Impact, per CVSS data, is MEDIUM: network access with exploitation requiring user interac...
CVE-2019-14387
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...
CVE-2019-14386
CVE-2019-14386 affects cPanel before 82.0.2, where a stored XSS vulnerability exists in the WHM Tomcat Manager interface (SEC-504). Impact is cross-site scripting; remediation is to upgrade to 82.0.2 or later (per provided sources). If exploitation details are not provided in the documents, note ...
CVE-2019-14386
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface SEC-504...
FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)
the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag does not close in the HTML being parsed. Because...
spamassassin -- multiple vulnerabilities
the Apache Spamassassin project reports: In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag does not close in the HTML being parsed. Because ...
Cross site scripting
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...
CVE-2018-16236
CVE-2018-16236 affects cPanel through version 74, allowing XSS via a crafted filename in the logs subdirectory of a user account. The root cause is that the filename is mishandled during rendering of frontend/THEME/raw/index.html, enabling script injection. Exploit details (in-the-wild, vectors) ...
cPanel Filename Based Stored XSS < v76 Exploit
Usage Info Create a file as named with your payload in /home/user/logs directory or run the php exploit. + Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "...
cPanel 76 Cross Site Scripting
Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "'; // end of the script. ? Note: You cant create a file as named with / slash character by this exploit. This vulnerability is...
CVE-2018-7734
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request...
CVE-2018-7735
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=listfiletypes request...
CVE-2018-7735
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=listfiletypes request...
CVE-2018-7734
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request...
Debian DSA-4092-1 : awstats - security update
The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
[SECURITY] [DSA 4092-1] awstats security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4092-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2018 https://www.debian.org/security/faq -...