Cpanel
Page 4 of 5 — Cpanel CVEs from a corpus of 430, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20902 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408). |
CVE-2018-20901 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400). |
CVE-2016-10860 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
CVE-2016-10859 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65). |
CVE-2016-10858 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). |
CVE-2016-10857 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
CVE-2016-10856 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
CVE-2016-10855 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91). |
CVE-2016-10854 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). |
CVE-2016-10853 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86). |
CVE-2016-10852 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
CVE-2016-10851 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). |
CVE-2016-10850 | High | 8.8 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). |
CVE-2015-9291 | High | 7.5 | 2019-08-01 | cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
CVE-2018-20900 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399). |
CVE-2018-20899 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398). |
CVE-2018-20898 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396). |
CVE-2018-20897 | Low | 2.8 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). |
CVE-2018-20896 | Low | 3.9 | 2019-08-01 | cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394). |
CVE-2018-20895 | High | 7.2 | 2019-08-01 | In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393). |
CVE-2018-20894 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443). |
CVE-2018-20893 | Low | 2.3 | 2019-08-01 | cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442). |
CVE-2018-20892 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439). |
CVE-2018-20891 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436). |
CVE-2018-20890 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
CVE-2018-20889 | Medium | 4.4 | 2019-08-01 | cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425). |
CVE-2018-20888 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). |
CVE-2018-20887 | Critical | 9.8 | 2019-08-01 | cPanel before 74.0.0 allows SQL injection during database backups (SEC-420). |
CVE-2018-20886 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418). |
CVE-2018-20885 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416). |
CVE-2018-20884 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367). |
CVE-2018-20883 | Medium | 6.5 | 2019-08-01 | cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). |
CVE-2018-20882 | Medium | 6.8 | 2019-08-01 | cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447). |
CVE-2018-20881 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446). |
CVE-2018-20880 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445). |
CVE-2018-20879 | Medium | 6.3 | 2019-08-01 | cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). |
CVE-2018-20878 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441). |
CVE-2018-20877 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437). |
CVE-2018-20876 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434). |
CVE-2018-20875 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433). |
CVE-2018-20874 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428). |
CVE-2018-20873 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409). |
CVE-2019-14414 | Low | 3.3 | 2019-07-30 | In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). |
CVE-2019-14413 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). |
CVE-2019-14412 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). |
CVE-2019-14411 | Medium | 5.3 | 2019-07-30 | cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). |
CVE-2019-14410 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). |
CVE-2019-14409 | Medium | 5.5 | 2019-07-30 | cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). |
CVE-2019-14408 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). |
CVE-2019-14407 | Low | 2.7 | 2019-07-30 | cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). |
CVE-2019-14406 | Medium | 6.1 | 2019-07-30 | cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). |
CVE-2019-14405 | High | 8.8 | 2019-07-30 | cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). |
CVE-2019-14404 | Medium | 5.5 | 2019-07-30 | cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). |
CVE-2019-14403 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). |
CVE-2019-14402 | Low | 3.3 | 2019-07-30 | cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). |
CVE-2019-14401 | High | 8.8 | 2019-07-30 | cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). |
CVE-2019-14400 | High | 7.8 | 2019-07-30 | cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). |
CVE-2019-14399 | High | 7.1 | 2019-07-30 | The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). |
CVE-2019-14398 | High | 8.8 | 2019-07-30 | cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). |
CVE-2019-14397 | Medium | 5.3 | 2019-07-30 | cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). |
CVE-2019-14396 | Low | 3.3 | 2019-07-30 | API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). |
CVE-2019-14395 | Low | 3.3 | 2019-07-30 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). |
CVE-2019-14394 | Medium | 5.5 | 2019-07-30 | cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). |
CVE-2019-14393 | Medium | 5.3 | 2019-07-30 | cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486). |
CVE-2018-20870 | Medium | 5.5 | 2019-07-30 | The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). |
CVE-2018-20869 | High | 7.8 | 2019-07-30 | cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). |
CVE-2018-20868 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). |
CVE-2018-20866 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). |
CVE-2018-20865 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). |
CVE-2018-20864 | Medium | 6.5 | 2019-07-30 | cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). |
CVE-2018-20863 | Critical | 9.8 | 2019-07-30 | cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). |
CVE-2018-20862 | High | 7.8 | 2019-07-30 | cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366). |
CVE-2019-14392 | High | 8.8 | 2019-07-30 | cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501). |
CVE-2018-20867 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462). |
CVE-2019-14391 | Low | 3.3 | 2019-07-30 | cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514). |
CVE-2019-14390 | Medium | 5.4 | 2019-07-30 | cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512). |
CVE-2019-14389 | High | 7.8 | 2019-07-30 | cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510). |
CVE-2019-14388 | High | 7.5 | 2019-07-30 | cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507). |
CVE-2019-14387 | Medium | 6.1 | 2019-07-30 | cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506). |
CVE-2019-14386 | Medium | 5.4 | 2019-07-30 | cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504). |
CVE-2018-16236 | Medium | 6.1 | 2018-08-30 | cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/in… |
CVE-2017-11441 | Medium | 5.4 | 2017-07-19 | The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 6… |
CVE-2017-5616 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter. |
CVE-2017-5615 | Medium | 6.1 | 2017-03-03 | cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location. |
CVE-2017-5614 | Medium | 6.1 | 2017-03-03 | Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors i… |
CVE-2017-5613 | High | 7.8 | 2017-03-03 | Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file. |
CVE-2009-4823 | | 2010-04-27 | Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script… | |
CVE-2008-7142 | | 2009-09-01 | Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary di… | |
CVE-2008-6927 | | 2009-08-10 | Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers… | |
CVE-2008-6926 | | 2009-08-10 | Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and ex… | |
CVE-2008-6843 | | 2009-07-02 | Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in t… | |
CVE-2009-2275 | | 2009-07-01 | Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domai… | |
CVE-2008-2478 | | 2008-05-28 | scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbi… | |
CVE-2008-2071 | | 2008-05-12 | Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote a… | |
CVE-2008-2070 | | 2008-05-12 | The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script… | |
CVE-2008-2043 | | 2008-05-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute arbitrary code via th… | |
CVE-2008-1499 | | 2008-03-25 | Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script o… | |
CVE-2008-0370 | | 2008-01-22 | Cross-site scripting (XSS) vulnerability in dohtaccess.html in cPanel before 11.17 build 19417 allows remote attackers to inject arbitrary web script or HTML v… | |
CVE-2007-4022 | | 2007-07-26 | Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2007-3367 | | 2007-06-22 | Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct req… |