[SECURITY] [DSA 4092-1] awstats security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4092-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2018 https://www.debian.org/security/faq -...

Updated perl packages fix security vulnerability

John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory which might be changed to another directory without the user realising and potentially leading to privilege escalation...

Updated awstats packages fix security vulnerability

The cPanel Security Team discovered two path traversal flaws in awstats in the "config" and "migrate" parameters that could be leveraged for unauthenticated remote code execution CVE-2017-1000501...

rubygem-passenger -- arbitrary file read vulnerability

Phusion reports: The cPanel Security Team discovered a vulnerability in Passenger that allows users to list the contents of arbitrary files on the system. CVE-2017-16355 has been assigned to this issue...

cPanel Cross-Site Scripting Vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. A cross-site scripting vulnerability in the cPanel WHM Upload Locale interface allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitiv...

Design/Logic Flaw

The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297...

CVE-2017-11441

The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297...

CVE-2017-11441

CVE-2017-11441 affects the cPanel WHM Upload Locale interface. Vulnerable versions include: before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2. The issue is an XSS via a locale filename (SEC-297). The connected documents corr...

CVE-2017-11441

The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297...

[SECURITY] [DSA 3873-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3873-1 (perl - security update)

The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to a attacker-chosen value. OpenVAS...

[SECURITY] [DLA 869-1] cgiemail security update

Package : cgiemail Version : 1.6-37+deb7u1 CVE ID : CVE-2017-5613 CVE-2017-5614 CVE-2017-5615 CVE-2017-5616 Debian Bug : 852031 The cPanel Security Team discovered several security vulnerabilities in cgiemail, a CGI program used to create HTML forms for sending mails: CVE-2017-5613 A format strin...

cgiemail and cgiecho format string vulnerabilities

cPanel is a Web-based hosting control management system from the U.S. company cPanel. The management system is mainly used to automate the control of web sites and servers. cgiemail is one of the mail servers. A format string vulnerability exists in cgiemail and cgiecho. An attacker can exploit...

Multiple vulnerabilities in cPanel (CNVD-2017-00925)

CPanel is a Web-based host control management system from CPanel, Inc. in the United States. The management system is mainly used for automated control of web sites and servers. cPanel suffers from cross-site scripting, information disclosure, and security bypass vulnerabilities. An attacker coul...

cPanel Cross Domain Scripting / Information Disclosure

=== Introduction === cPanel offers web hosting software that automates the intricate workings of web hosting servers. cPanel equips server administrators with the necessary tools to provide top-notch hosting to customers on tens of thousands of servers worldwide. === Description === I Cross Domai...

Cgiemail 1.6 Source Code Disclosure Exploit

Exploit for php platform in category web applications !/usr/bin/env perl Exploit Title: cgiemail local file inclusion Vendor Homepage: http://web.mit.edu/wwwdev/cgiemail/webmaster.html Software Link: http://web.mit.edu/wwwdev/cgiemail/cgiemail-1.6.tar.gz Version: 1.6 and older Date: 2016-09-27...

Cgiemail 1.6 - Source Code Disclosure

!/usr/bin/env perl Exploit Title: cgiemail local file inclusion Vendor Homepage: http://web.mit.edu/wwwdev/cgiemail/webmaster.html Software Link: http://web.mit.edu/wwwdev/cgiemail/cgiemail-1.6.tar.gz Version: 1.6 and older Date: 2016-09-27 cgiecho a script included with cgiemail will return any...

Cgiemail 1.6 - Source Code Disclosure

Cgiemail 1.6 - Source Code Disclosure !/usr/bin/env perl Exploit Title: cgiemail local file inclusion Vendor Homepage: http://web.mit.edu/wwwdev/cgiemail/webmaster.html Software Link: http://web.mit.edu/wwwdev/cgiemail/cgiemail-1.6.tar.gz Version: 1.6 and older Date: 2016-09-27 cgiecho a script...

cba.pl XSS vulnerability

Vulnerable URL: http://www.cba.pl/panel/en/%22%3E%3Csvg%20onload=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 09.04.2016 Latest check for patch:| 09.04.2016 11:32 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 13173 Google...

GoAutoDial GoAdmin CE 'cpanel' Arbitrary Command Execution Vulnerability

GoAutoDial is a set of open source Web-based call center software running on CentOS systems.GoAdmin CE is one of the set of administrator applications. A security vulnerability in the 'cpanel' function in the gosite.php script of GoAutoDial GoAdmin CE allows remote attackers to execute arbitrary...