1621 matches found
CVE-2016-10805
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...
Design/Logic Flaw
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process SEC-114...
Design/Logic Flaw
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...
Code injection
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs SEC-113...
Design/Logic Flaw
cPanel before 58.0.4 allows a file-ownership change to nobody via rearrangeacct SEC-134...
Design/Logic Flaw
cPanel before 58.0.4 has improper session handling for shared users SEC-139...
CVE-2016-10811
CVE-2016-10811 affects cPanel prior to 57.9999.54, where the script /scripts/unsuspendacct exposes TTYs (SEC-116). The public description confirms the vulnerability is tied to this script, with high impact in both confidentiality, integrity, and availability (CVSSv3 8.8). Red Hat and CNVD referen...
CVE-2016-10810
Summary: CVE-2016-10810 affects cPanel prior to 57.9999.54, where the script /scripts/maildir_converter exposes a TTY to an unprivileged process (SEC‑115). The issue is documented across multiple sources (NVD entry and Red Hat, CNVD, etc.). Impact details: CVSS metrics in the NVD entry indicate a...
CVE-2016-10809
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process SEC-114...
CVE-2016-10809
CVE-2016-10809 : In cPanel before 57.9999.54, the script path /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). This creates a high-risk exposure for confidentiality, integrity, and availability per the CVSS metrics, with an attack vector of network and low complexity. T...
CVE-2016-10808
CVE-2016-10808 affects cPanel prior to 57.9999.54. The endpoints /scripts/addpop and /scripts/delpop expose TTYs (SEC-113), enabling potential attacker access with high impact on confidentiality, integrity, and availability (CVSSv3 base score 8.8). No remediation details are provided in the suppl...
CVE-2016-10808
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs SEC-113...
CVE-2016-10805
CVE-2016-10805 affects cPanel versions prior to 57.9999.54. The issue allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109), enabling remote code execution with the potential for full control under the public-facing web interface. According to connected sources...
CVE-2016-10804
The CVE-2016-10804 issue affects cPanel prior to 57.9999.54, where the SQLite journal feature can cause arbitrary file overwrites during Horde Restore (SEC-58). Root cause: misuse of the SQLite journal leads to write operations to arbitrary files. Impact (per sources): High, with potential confid...
CVE-2016-10802
CVE-2016-10802 affects cPanel prior to 58.0.4, allowing code execution in the context of other user accounts through the PHP CGI handler (SEC-142). Connected sources confirm the vendor advisory and a fixed version (58.0.4); no exploitation details are provided in the documents. Recommended action...
CVE-2016-10801
Affected product: cPanel. Vulnerability CVE-2016-10801 exists in versions before 58.0.4 due to improper session handling for shared users (SEC-139). Root cause: flawed session management in the system. Impact described by CVSS3 as high (C/H/I/A) with base score 8.8; CVSS2 as 6.5. Mitigation: upgr...
CVE-2016-10800
Affected software: cPanel prior to 58.0.4. Vulnerability: demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). Root cause / impact: the issue allows escape in demo mode, with impact characterized as partial confidentiality/integrity/availability risk per the cited sources. Expl...
CVE-2016-10799
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation SEC-137...