2056 matches found
CVE-2016-10772
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin SEC-168...
CVE-2016-10772
CVEs surrounding cPanel 2016-10772 : The vulnerability affects cPanel before 60.0.25, where the system does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). Multiple connected sources (Red Hat CVE entry, CNVD-2019-29623, NVD entry) reiterate the same descriptio...
CVE-2016-10770
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update SEC-164...
CVE-2016-10770
CVE-2016-10770 affects cPanel prior to 60.0.25. The vulnerability allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). The provided documents consistently describe this as a cPanel issue related to the update process, with no additional technical details (e.g., affected...
CVE-2016-10769
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi SEC-162...
CVE-2017-18481
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...
CVE-2017-18481
CVE-2017-18481 affects cPanel (specifically the WHM Account Suspension List interface) prior to version 62.0.4. The issue is a stored XSS vulnerability caused by insufficient input validation in the web interface, allowing attacker-supplied script to be stored and potentially executed in victims’...
CVE-2017-18480
CVE-2017-18480 affects cPanel/WHM: prior to 62.0.4, has_mycnf_for_cpuser API calls do not enforce account ownership, per SEC-210. Root cause is missing ownership checks in those WHM API calls. Impact as stated: potential exposure of sensitive configuration data via API calls; CVSS v3 vector indic...
CVE-2017-18479
CVE-2017-18479 affects cPanel prior to 62.0.4, where WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). The issue is documented with CVSS metrics (CVSSv2 base 4.0, MEDIUM; CVSSv3 base 6.5, MEDIUM). Affected component: WHM/cPanel SSL certificate generation process; root ca...
CVE-2017-18478
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions SEC-207...
CVE-2017-18478
Affected software: cPanel prior to 62.0.4. Vulnerability: incorrect ACL checks in xml-api for Rearrange Account actions, caused by an ACL bypass issue. Impact: potential improper access control. Mitigation: upgrade to 62.0.4 or later (as cited by cPanel and related CVE records). Notes: the connec...
CVE-2017-18477
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account SEC-206...
CVE-2017-18476
Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...
CVE-2017-18476
CVE-2017-18476 concerns Leech Protect in cPanel prior to 62.0.4 not protecting certain directories (bug tracked as SEC-205). The connected sources consistently state this issue affecting cPanel. No further technical details (root cause, impacted components beyond Leech Protect, exploit vectors, o...
CVE-2017-18474
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases SEC-201...
CVE-2017-18473
CVE-2017-18473 affects cPanel before 62.0.4, where the Webmail Password and Security page is vulnerable to a self-XSS due to insufficient input validation. Root cause cited in CNVD as lack of proper validation of client-side data. Impact is self-XSS on affected page; exploitation details are not ...
CVE-2017-18471
Summary: CVE-2017-18471 affects cPanel versions before 62.0.4. The issue is a self‑XSS vulnerability on the paper_lantern password‑change screen. Affected software/component: cPanel hosting control panel; paper_lantern password‑change UI. Root cause: Self‑XSS due to insufficient input/output hand...
CVE-2017-18471
cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...
CVE-2017-18469
CVE-2017-18469 affects cPanel prior to 62.0.17, where demo accounts can execute code via an NVData_fetchinc API call (SEC-233). Affected software: cPanel versions before 62.0.17. Root cause: exploitable API call allowing code execution. Impact: potential arbitrary code execution by unauthenticate...
