CVE-2016-10817

CVE-2016-10817 affects cPanel prior to version 57.9999.54, where a SQL injection is possible via the ModSecurity TailWatch log file (SEC-123). Affected software is explicitly stated as cPanel; root cause is unvalidated SQL operations exposed through TailWatch. Impact is defined as high/critical i...

CVE-2016-10819

CVE-2016-10819 affects cPanel before 57.9999.54. When cpanellogd rotates user log files, they become world-readable, exposing user logs (classified as a confidentiality impact). The vulnerability is described consistently across multiple sources (NVD, Red Hat, CNVD, CVE listings). Remediation is ...

CVE-2016-10820

cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20936

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf SEC-308...

CVE-2018-20947

cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script SEC-356...

CVE-2016-10830

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magicrevision SEC-100...

CVE-2016-10828

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path SEC-97...

CVE-2016-10832

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging SEC-102...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10827

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

Design/Logic Flaw

cPanel before 68.0.27 allows self XSS in the WHM listips interface SEC-389...

Design/Logic Flaw

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

Authentication flaw

cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging SEC-107...

Cross site scripting

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

Design/Logic Flaw

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents SEC-92...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf SEC-308...

Design/Logic Flaw

cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin SEC-349...

Design/Logic Flaw

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...