Filtered by vendor Cpanel
Subscribe
Total
426 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2008-2478 | 1 Cpanel | 1 Cpanel | 2024-05-17 | 8.5 HIGH | N/A |
| ** DISPUTED ** scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel." | |||||
| CVE-2023-29489 | 1 Cpanel | 1 Cpanel | 2024-02-04 | N/A | 6.1 MEDIUM |
| An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | |||||
| CVE-2021-38586 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 2.1 LOW | 4.4 MEDIUM |
| In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | |||||
| CVE-2021-38588 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 6.8 MEDIUM | 8.1 HIGH |
| In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | |||||
| CVE-2021-38590 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 2.1 LOW | 5.5 MEDIUM |
| In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | |||||
| CVE-2021-38584 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | |||||
| CVE-2021-38589 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.5 MEDIUM | 8.1 HIGH |
| In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | |||||
| CVE-2021-31803 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | |||||
| CVE-2021-38585 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). | |||||
| CVE-2021-38587 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | |||||
| CVE-2020-26113 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). | |||||
| CVE-2020-26108 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). | |||||
| CVE-2020-26098 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). | |||||
| CVE-2020-26104 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). | |||||
| CVE-2020-26112 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| The email quota cache in cPanel before 90.0.10 allows overwriting of files. | |||||
| CVE-2020-26106 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). | |||||
| CVE-2020-26111 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). | |||||
| CVE-2020-26103 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). | |||||
| CVE-2020-26110 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). | |||||
| CVE-2020-26099 | 1 Cpanel | 1 Cpanel | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). | |||||