1621 matches found
CVE-2018-20916
cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...
CVE-2018-20916
CVE-2018-20916 affects cPanel prior to 70.0.23. The vulnerability is a Stored XSS in WHM via the Edit MX Entry, caused by lack of proper validation of client-side data in the web application. Impact stated as attacker-controlled scripts executed in the victim’s browser. Remediation: upgrade to 70...
CVE-2016-10853
Summary: CVE-2016-10853 affects cPanel before 11.54.0.4, with a stored XSS vulnerability in the WHM Feature Manager interface (SEC-86). Multiple connected sources (NVD/NVD mirror, Red Hat security page, CNVD) corroborate this description. What’s vulnerable: The WHM Feature Manager component of cP...
CVE-2018-20914
CVE-2018-20914 affects cPanel before 70.0.23. OpenID providers can inject arbitrary data into cPanel session files (SEC-368), enabling manipulation of session state and potentially impacting the confidentiality and integrity of session data. Affected versions are cPanel prior to 70.0.23. Mitigati...
CVE-2016-10854
CVE-2016-10854 affects cPanel prior to 11.54.0.4, where the X3 Entropy Banner interface is vulnerable to a self XSS. The description is corroborated across multiple feeds (e.g., NVD and RH advisories) as a self-XSS in the X3 Entropy Banner. The available sources do not provide exploit details or ...
CVE-2018-20913
cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...
CVE-2018-20913
CVE-2018-20913 affects cPanel before 70.0.23. The vulnerability allows an attacker to read the root accesshash via the WHM path /cgi/trustclustermaster.cgi (SEC-364). The available sources describe the vulnerability as an information disclosure condition impacting the root accesshash, with no pub...
CVE-2018-20912
Summary: CVE-2018-20912 affects cPanel before 70.0.23, where demo accounts could cause code execution via awstats (SEC-362). The issue is reported across multiple sources (e.g., Red Hat and CNVD entries) with the consistent description that vulnerable versions prior to 70.0.23 permit arbitrary co...
CVE-2018-20911
cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup SEC-359...
CVE-2016-10858
CVE-2016-10858 affects cPanel before 11.54.0.0, allowing unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). Data: multiple sources confirm impact on the cPanel product; remediation indicated is upgrading to 11.54.0.0 or later. Exploitation details and in-the-wild status...
CVE-2016-10860
CVE-2016-10860 affects cPanel before 11.54.0.0 and is documented as allowing unauthorized zone modification through the WHM API (SEC-66). The vulnerability is corroborated across multiple sources in the connected documents (NVD entry and Red Hat advisory), which state the same affected software a...
CVE-2018-20910
The CVE-2018-20910 entry concerns cPanel before 70.0.23, where the WHM cPAddons showsecurity interface is vulnerable to self-XSS. The issue stems from insufficient validation of client-side data, enabling an attacker to execute client-side code in affected versions. Public references indicate the...
CVE-2018-20909
CVE-2018-20909 affects cPanel prior to 70.0.23, where arbitrary file-chmod operations can occur during legacy incremental backups (SEC-338). Multiple sources (NVD, Red Hat advisory, CNVD) confirm the issue and link it to cPanel’s backup handling. The vulnerability arises in the backup process, en...
CVE-2018-20906
CVE-2018-20906 affects cPanel before 71.9980.37. The issue allows attackers to make API calls that bypass the images feature restriction (SEC-430). The connected documents confirm the product (cPanel), affected version range (before 71.9980.37), and the described impact (bypassing images feature ...
CVE-2018-20904
CVE-2018-20904 affects cPanel before 71.9980.37, where API calls can bypass the cron feature restriction (SEC-427). The issue is triggered by improper authorization/validation in API handling, enabling potential unauthorized cron-related actions. Remediation: upgrade to cPanel 71.9980.37 or later...
CVE-2018-20903
CVE-2018-20903 concerns cPanel prior to 71.9980.37, where the WHM Backup Configuration interface is vulnerable to self-XSS (SEC-421). The root cause is user input not properly validated client-side, allowing injected script when viewed in the backup config context. Impact is self-XSS in the inter...
CVE-2018-20901
CVE-2018-20901 affects cPanel before 71.9980.37 and enables Remote-Stored XSS in the WHM Save Theme Interface (SEC-400). The incident is described as XSS that can be triggered remotely via the Save Theme UI, with a CVSS v3 base score of 6.1 (MEDIUM) and CVSS v2 base score 4.3 (MEDIUM). The availa...
CVE-2018-20900
cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality SEC-399...