Cpanel
Page 3 of 5 — Cpanel CVEs from a corpus of 430, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18393 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). |
CVE-2017-18392 | Low | 2.0 | 2019-08-02 | cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). |
CVE-2017-18391 | Low | 2.5 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). |
CVE-2017-18390 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). |
CVE-2017-18389 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). |
CVE-2017-18388 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). |
CVE-2017-18387 | High | 7.2 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). |
CVE-2017-18386 | High | 7.2 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). |
CVE-2017-18385 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
CVE-2017-18384 | Low | 3.8 | 2019-08-02 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
CVE-2017-18383 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). |
CVE-2017-18382 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
CVE-2016-10826 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). |
CVE-2016-10821 | Medium | 6.5 | 2019-08-01 | In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). |
CVE-2016-10820 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
CVE-2016-10819 | Medium | 6.5 | 2019-08-01 | In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). |
CVE-2016-10818 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). |
CVE-2016-10817 | Critical | 9.8 | 2019-08-01 | cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). |
CVE-2016-10816 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). |
CVE-2016-10815 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). |
CVE-2016-10814 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). |
CVE-2016-10813 | Medium | 5.4 | 2019-08-01 | cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). |
CVE-2018-20953 | Medium | 6.1 | 2019-08-01 | cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389). |
CVE-2018-20952 | Medium | 6.5 | 2019-08-01 | cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388). |
CVE-2018-20951 | Medium | 6.1 | 2019-08-01 | cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387). |
CVE-2018-20950 | Medium | 6.1 | 2019-08-01 | cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386). |
CVE-2018-20949 | Medium | 6.1 | 2019-08-01 | cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385). |
CVE-2018-20948 | Medium | 6.1 | 2019-08-01 | cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383). |
CVE-2018-20947 | Medium | 5.5 | 2019-08-01 | cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356). |
CVE-2018-20946 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355). |
CVE-2018-20945 | Medium | 5.7 | 2019-08-01 | bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354). |
CVE-2018-20944 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353). |
CVE-2018-20943 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352). |
CVE-2018-20942 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351). |
CVE-2018-20941 | Medium | 5.6 | 2019-08-01 | cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349). |
CVE-2018-20940 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342). |
CVE-2018-20939 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339). |
CVE-2018-20938 | Low | 2.7 | 2019-08-01 | cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
CVE-2018-20937 | Medium | 4.3 | 2019-08-01 | cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321). |
CVE-2018-20936 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308). |
CVE-2016-10835 | Medium | 4.3 | 2019-08-01 | cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). |
CVE-2016-10834 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). |
CVE-2016-10833 | High | 7.5 | 2019-08-01 | cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). |
CVE-2016-10832 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). |
CVE-2016-10831 | High | 7.2 | 2019-08-01 | cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). |
CVE-2016-10830 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
CVE-2016-10829 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99). |
CVE-2016-10828 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). |
CVE-2016-10827 | Medium | 5.4 | 2019-08-01 | cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96). |
CVE-2016-10825 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). |
CVE-2016-10824 | Critical | 9.8 | 2019-08-01 | cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). |
CVE-2016-10823 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). |
CVE-2016-10822 | Medium | 5.4 | 2019-08-01 | cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). |
CVE-2018-20935 | Medium | 5.4 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412). |
CVE-2018-20934 | Medium | 6.5 | 2019-08-01 | cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). |
CVE-2018-20933 | Medium | 5.4 | 2019-08-01 | cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410). |
CVE-2018-20932 | Low | 2.7 | 2019-08-01 | cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406). |
CVE-2018-20931 | Medium | 6.3 | 2019-08-01 | cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405). |
CVE-2018-20930 | Medium | 6.5 | 2019-08-01 | cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). |
CVE-2018-20929 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392). |
CVE-2018-20928 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391). |
CVE-2018-20927 | Low | 3.8 | 2019-08-01 | cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382). |
CVE-2018-20926 | Medium | 6.7 | 2019-08-01 | cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380). |
CVE-2018-20925 | Medium | 6.7 | 2019-08-01 | cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379). |
CVE-2018-20924 | Medium | 5.5 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378). |
CVE-2016-10849 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). |
CVE-2016-10848 | High | 7.2 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81). |
CVE-2016-10847 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80). |
CVE-2016-10846 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). |
CVE-2016-10845 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78). |
CVE-2016-10844 | Medium | 6.5 | 2019-08-01 | The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). |
CVE-2016-10843 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). |
CVE-2016-10842 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74). |
CVE-2016-10841 | Medium | 5.3 | 2019-08-01 | The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73). |
CVE-2016-10840 | High | 8.8 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72). |
CVE-2016-10839 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). |
CVE-2016-10838 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
CVE-2016-10837 | High | 7.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46). |
CVE-2016-10836 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). |
CVE-2018-20923 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377). |
CVE-2018-20922 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376). |
CVE-2018-20921 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375). |
CVE-2018-20920 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374). |
CVE-2018-20919 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373). |
CVE-2018-20918 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372). |
CVE-2018-20917 | Medium | 5.5 | 2019-08-01 | cPanel before 70.0.23 allows any user to disable Solr (SEC-371). |
CVE-2018-20916 | Medium | 5.4 | 2019-08-01 | cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370). |
CVE-2018-20915 | Medium | 5.4 | 2019-08-01 | cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369). |
CVE-2018-20914 | High | 7.3 | 2019-08-01 | In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368). |
CVE-2018-20913 | Medium | 4.9 | 2019-08-01 | cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364). |
CVE-2018-20912 | Medium | 6.3 | 2019-08-01 | cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). |
CVE-2018-20911 | High | 7.2 | 2019-08-01 | cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359). |
CVE-2018-20910 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357). |
CVE-2018-20909 | High | 7.1 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). |
CVE-2018-20908 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). |
CVE-2018-20907 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432). |
CVE-2018-20906 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430). |
CVE-2018-20905 | Medium | 5.4 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). |
CVE-2018-20904 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427). |
CVE-2018-20903 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421). |