1621 matches found
Cross site scripting
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing SEC-269...
CVE-2017-18436
The CVE-2017-18436 issue affects cPanel prior to 64.0.21, where demo accounts can read files via the Fileman::getfileactions API2 call (SEC-239). Root cause: insufficient access control in the Fileman API allowing read access to files. Impact: potential partial disclosure of file contents for dem...
CVE-2017-18436
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...
CVE-2017-18433
CVE-2017-18433 affects cPanel prior to version 64.0.21. The vulnerability allows code execution via the store_filter API call initiated by webmail and demo accounts (SEC-236). Multiple sources (Red Hat, CNVD, NVD, CVE registry) corroborate that the flaw exists in older cPanel builds; no public ex...
CVE-2017-18432
CVE-2017-18432 affects cPanel prior to 64.0.21, specifically the Horde MySQL to SQLite conversion process. The underlying issue is a leakage of a database password (SEC-234) during the conversion, enabling potential disclosure of database credentials. This vulnerability has a high impact on confi...
CVE-2017-18429
CVE-2017-18429 affects cPanel before 66.0.2. The issue is that Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Several connected sources corroborate the same description, without detailing root cause, exploited vectors, or remediation steps in the pr...
CVE-2017-18428
CVE-2017-18428 affects cPanel prior to 66.0.2. During log processing, Apache HTTP Server domlogs become temporarily world-readable, exposing potentially sensitive log information. This is caused by the log handling behavior described in SEC-290. The vulnerability is a local issue with information...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18423
In this CVE, affected software is cPanel prior to 66.0.2. The issue causes domain log files to become readable after log processing (SEC-273). The provided documents do not specify the root cause details, affected components beyond the log handling, or a remediation/version fix. No exploitation d...
CVE-2017-18421
cPanel prior to 66.0.2 contains a vulnerability (SEC-271) that allows demo accounts to create databases and users. Affected: cPanel before 66.0.2. Root cause specifics are not detailed in the provided documents. Impact stated as unauthorized creation/management of databases and users. Remediation...
CVE-2017-18419
CVE-2017-18419 affects cPanel before 66.0.2. The issue is a stored XSS during WHM cPAddons uninstallation caused by insufficient input validation in the cPAddons uninstall flow. The vulnerability can lead to arbitrary script execution within the context of affected users when the uninstallation U...
CVE-2017-18417
CVE-2017-18417 affects cPanel prior to 66.0.2, where stored XSS can occur during WHM cPAddons installation. The vulnerability is tied to the cPAddons installation flow in WHM, enabling injected client-side scripts. Red Hat and CNVD entries corroborate the same issue with versions before 66.0.2. R...
CVE-2017-18403
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...
CVE-2017-18404
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...
CVE-2017-18394
cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...
CVE-2017-18397
cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...
CVE-2017-18402
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...