577 matches found
Design/Logic Flaw
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...
Design/Logic Flaw
cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...
Code injection
cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...
Cross site scripting
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...
CVE-2016-10767
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...
CVE-2017-18482
cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...
CVE-2017-18482
CVE-2017-18482 affects cPanel before 62.0.4; the issue arises from resellers using the WHM enqueue_transfer_item API to queue non-rearrange modules (SEC-213). Root cause: exposed API misuse in WHM allowing unauthorized queueing actions. Impact: potential partial availability impact per CVSS v3 sc...
CVE-2017-18481
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...
CVE-2017-18480
CVE-2017-18480 affects cPanel/WHM: prior to 62.0.4, has_mycnf_for_cpuser API calls do not enforce account ownership, per SEC-210. Root cause is missing ownership checks in those WHM API calls. Impact as stated: potential exposure of sensitive configuration data via API calls; CVSS v3 vector indic...
CVE-2017-18480
cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...
CVE-2017-18479
CVE-2017-18479 affects cPanel prior to 62.0.4, where WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). The issue is documented with CVSS metrics (CVSSv2 base 4.0, MEDIUM; CVSSv3 base 6.5, MEDIUM). Affected component: WHM/cPanel SSL certificate generation process; root ca...
CVE-2017-18479
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address SEC-209...
CVE-2017-18464
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...
Design/Logic Flaw
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...
CVE-2017-18464
CVE-2017-18464 affects cPanel before 62.0.17. The vulnerability arises in the WHM Zone Template editor (SEC-226), allowing arbitrary file overwrite due to insufficient input validation. Impact stated as potential for unauthorized file modification. The Red Hat and other sources confirm the same d...
CVE-2017-18464
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...
cPanel cross-site scripting vulnerability (CNVD-2019-26357)
cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the WHM Feature Manager interface in versions prior to cPanel 11.54.0.4...
CVE-2017-18457
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...