2056 matches found
Code injection
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...
CVE-2016-10795
The CVE-2016-10795 entry affects cPanel/WHM, where a stored XSS vulnerability exists in the WHM tail_upcp2.cgi interface. Affected versions are prior to 59.9999.145. The issue stems from insufficient validation of client-side data in the web application, enabling an attacker to execute client-sid...
CVE-2016-10794
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error SEC-154...
CVE-2016-10793
CVE-2016-10793 affects cPanel prior to 59.9999.145. The root cause is an incorrect #! in Mail::SPF scripts that enables arbitrary code execution. Affected software is cPanel versions before 59.9999.145; the vulnerability allows code execution with the privilege level of the web server. Remediatio...
CVE-2016-10789
CVE-2016-10789 affects cPanel prior to 60.0.25. The cpsrvd 403 error response handler can be exploited to achieve code execution (SEC-191). Multiple connected sources corroborate this vulnerability entry. Impact is high if exploited; remediation is to upgrade to 60.0.25 or later (i.e., non-vulner...
CVE-2016-10788
CVE-2016-10788 concerns cPanel prior to 60.0.25, where an arbitrary code execution vulnerability exists via Maketext in the PostgreSQL adminbin (SEC-188). The Red Hat and CVE records corroborate the same description. Affected product: cPanel; affected component: Maketext usage in PostgreSQL admin...
CVE-2016-10787
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries SEC-187...
CVE-2016-10786
The CVE-2016-10786 entry affects cPanel before 60.0.25, where members of the nobody group can read Apache HTTP Server SSL private keys (information disclosure). Root cause is insufficient access control permitting read access to SSL keys by unauthorized system users. Red Hat and CNVD entries corr...
CVE-2016-10785
CVE-2016-10785 affects cPanel prior to 60.0.25, where an attacker could disclose file contents during file copy operations (SEC-185). Root cause described as an information disclosure vulnerability in the file-copy process. The practical impact is information disclosure of file contents; exploita...
CVE-2016-10784
cPanel before 60.0.25 allows self XSS in the alias upload interface SEC-184...
CVE-2016-10784
CVE-2016-10784 affects cPanel prior to 60.0.25, where the alias upload interface is vulnerable to self-XSS (SEC-184) due to insufficient input validation. The issue enables an attacker with access to the alias upload flow to inject and execute client-side code. The vulnerability was identified in...
CVE-2016-10783
CVE-2016-10783 affects cPanel before 60.0.25, where a self‑stored XSS is possible in SSL_listkeys due to insufficient validation in the web application. The vulnerability allows attacker‑controlled data to be stored and later reflected in the client, enabling cross‑site scripting. Affected produc...
CVE-2016-10782
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...
CVE-2016-10782
CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...
CVE-2016-10781
CVE-2016-10781 affects cPanel prior to 60.0.25, where the UI_confirm API is vulnerable to self-XSS due to insufficient validation of client-side data. The vulnerability can allow an attacker to execute client-side code via the UI_confirm interface, as described in the public records (SEC-180). Th...
CVE-2016-10779
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...
CVE-2016-10779
CVE-2016-10779 affects cPanel prior to 60.0.25, with a stored XSS in api1_listautoresponders due to insufficient input validation in the web application. The vulnerability can lead to execution of client-side code in affected sessions. Remediation: upgrade to version 60.0.25 or later (as noted in...
CVE-2016-10779: Improper Neutralization of Input During Web Page Generation
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...