EUVD-2026-42360

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files...

CVE-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

CVE-2016-10771

cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing SEC-165...

CVE-2016-10846

cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions SEC-79...

EUVD-2017-9566

Malware in sbrugna...

CVE-2016-10849

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...

cPanel Authorization Issues Vulnerability (CNVD-2019-36140)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An authorization issue vulnerability exists in versions of cPanel prior to 11.54.0.4. The vulnerability stems from a lack of...

CVE-2016-10771

CVE-2016-10771 affects cPanel before 60.0.25, allowing file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). The issue resides in the ModSecurity audit logfile processing path, enabling unauthorized changes to filesystem state. Multiple connected sources cor...

PT-2019-7567

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows file-create and file-chmod operations during ModSecurity Audit logfile processing. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the...

CVE-2016-10771: Improper Input Validation

cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing SEC-165...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

Code injection

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18450

CVE-2017-18450 affects cPanel prior to 64.0.21 and is associated with file-chmod operations via the script /scripts/convert_roundcube_mysql2sqlite (SEC-255). The vulnerability is documented across multiple sources (NVD, Red Hat, CVE lists) as allowing certain file permission changes and has CVSS ...

PT-2019-8385

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 64.0.21 Description The issue allows certain file-chmod operations via the /scripts/convert roundcube mysql2sqlite endpoint. Recommendations For versions prior to 64.0.21, update to version 64.0.21 or later to resolve...

CVE-2017-18450: Undefined Security Weakness

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2016-10846

cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions SEC-79...

CVE-2016-10849

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...

Code injection

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...

CVE-2016-10846

CVE-2016-10846 affects cPanel prior to 11.54.0.4, enabling arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). The issue is rooted in the Roundcube database conversion process and allows limited privileges to perform file ownership and permission changes...