Cpanel
Page 2 of 5 — Cpanel CVEs from a corpus of 430, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10777 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177). |
CVE-2016-10776 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174). |
CVE-2017-18482 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). |
CVE-2017-18481 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211). |
CVE-2017-18480 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210). |
CVE-2017-18479 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). |
CVE-2017-18478 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). |
CVE-2017-18477 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206). |
CVE-2017-18476 | High | 7.5 | 2019-08-05 | Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). |
CVE-2017-18475 | High | 8.8 | 2019-08-05 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). |
CVE-2017-18474 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). |
CVE-2017-18473 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199). |
CVE-2017-18472 | Medium | 6.1 | 2019-08-05 | cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). |
CVE-2017-18471 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197). |
CVE-2017-18470 | High | 8.8 | 2019-08-05 | cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). |
CVE-2017-18469 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). |
CVE-2016-10775 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). |
CVE-2016-10774 | Medium | 5.4 | 2019-08-05 | cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172). |
CVE-2016-10773 | High | 8.8 | 2019-08-05 | cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171). |
CVE-2016-10772 | Low | 3.3 | 2019-08-05 | cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). |
CVE-2016-10771 | High | 8.1 | 2019-08-05 | cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). |
CVE-2016-10770 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). |
CVE-2016-10769 | Medium | 6.1 | 2019-08-05 | cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). |
CVE-2016-10768 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). |
CVE-2016-10767 | Medium | 5.4 | 2019-08-05 | cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). |
CVE-2017-18468 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). |
CVE-2017-18467 | Medium | 4.3 | 2019-08-05 | cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229). |
CVE-2017-18466 | Low | 2.7 | 2019-08-05 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
CVE-2017-18465 | Medium | 4.4 | 2019-08-05 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). |
CVE-2017-18464 | Medium | 4.9 | 2019-08-05 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
CVE-2017-18462 | High | 7.5 | 2019-08-05 | cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224). |
CVE-2017-18463 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
CVE-2017-18461 | Medium | 4.3 | 2019-08-02 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
CVE-2017-18460 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
CVE-2017-18459 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
CVE-2017-18458 | Low | 3.3 | 2019-08-02 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
CVE-2017-18457 | Medium | 4.4 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). |
CVE-2017-18456 | Medium | 6.1 | 2019-08-02 | cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). |
CVE-2017-18455 | Low | 2.7 | 2019-08-02 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). |
CVE-2017-18454 | Medium | 5.4 | 2019-08-02 | cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). |
CVE-2017-18453 | Medium | 4.9 | 2019-08-02 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
CVE-2017-18452 | Medium | 6.7 | 2019-08-02 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
CVE-2017-18451 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). |
CVE-2017-18450 | Medium | 4.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). |
CVE-2017-18449 | Medium | 5.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |
CVE-2017-18448 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). |
CVE-2017-18447 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). |
CVE-2017-18446 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). |
CVE-2017-18445 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). |
CVE-2017-18444 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). |
CVE-2017-18443 | Medium | 5.8 | 2019-08-02 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). |
CVE-2017-18442 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). |
CVE-2017-18441 | Medium | 5.0 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). |
CVE-2017-18440 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). |
CVE-2017-18439 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). |
CVE-2017-18438 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). |
CVE-2017-18437 | Medium | 4.4 | 2019-08-02 | cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). |
CVE-2017-18436 | Low | 3.5 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). |
CVE-2017-18435 | High | 7.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). |
CVE-2017-18434 | High | 7.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
CVE-2017-18433 | High | 8.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). |
CVE-2017-18432 | High | 7.8 | 2019-08-02 | In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). |
CVE-2017-18431 | High | 7.5 | 2019-08-02 | cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). |
CVE-2017-18430 | Medium | 4.7 | 2019-08-02 | In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). |
CVE-2017-18429 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). |
CVE-2017-18428 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). |
CVE-2017-18427 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). |
CVE-2017-18426 | Low | 2.7 | 2019-08-02 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). |
CVE-2017-18425 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280). |
CVE-2017-18424 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). |
CVE-2017-18423 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). |
CVE-2017-18422 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). |
CVE-2017-18421 | Low | 3.3 | 2019-08-02 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). |
CVE-2017-18420 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269). |
CVE-2017-18419 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266). |
CVE-2017-18418 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265). |
CVE-2017-18417 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263). |
CVE-2017-18416 | Medium | 5.5 | 2019-08-02 | cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). |
CVE-2017-18415 | High | 7.8 | 2019-08-02 | cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). |
CVE-2017-18414 | High | 7.4 | 2019-08-02 | cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). |
CVE-2017-18413 | High | 7.8 | 2019-08-02 | In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299). |
CVE-2017-18412 | Low | 2.5 | 2019-08-02 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). |
CVE-2017-18411 | Medium | 6.8 | 2019-08-02 | The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). |
CVE-2017-18410 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). |
CVE-2017-18409 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). |
CVE-2017-18408 | Medium | 5.4 | 2019-08-02 | cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). |
CVE-2017-18407 | Medium | 4.8 | 2019-08-02 | cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279). |
CVE-2017-18406 | High | 7.5 | 2019-08-02 | cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). |
CVE-2017-18405 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). |
CVE-2017-18404 | Low | 3.1 | 2019-08-02 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). |
CVE-2017-18403 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). |
CVE-2017-18402 | Medium | 5.4 | 2019-08-02 | cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336). |
CVE-2017-18401 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). |
CVE-2017-18400 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). |
CVE-2017-18399 | Low | 3.7 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332). |
CVE-2017-18398 | Low | 3.8 | 2019-08-02 | DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). |
CVE-2017-18397 | Low | 3.3 | 2019-08-02 | cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330). |
CVE-2017-18396 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). |
CVE-2017-18395 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of ssl (SEC-328). |
CVE-2017-18394 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). |