Filtered by vendor Cpanel
Subscriptions
Filtered by product Cpanel
Subscriptions
Total
417 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2008-2478 | 1 Cpanel | 1 Cpanel | 2024-05-17 | N/A |
| scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel. | ||||
| CVE-2004-1603 | 1 Cpanel | 1 Cpanel | 2024-01-26 | 5.5 Medium |
| cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. | ||||
| CVE-2008-2071 | 1 Cpanel | 1 Cpanel | 2023-11-07 | N/A |
| Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors. | ||||
| CVE-2008-2070 | 1 Cpanel | 1 Cpanel | 2023-11-07 | N/A |
| The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors. | ||||
| CVE-2021-26267 | 1 Cpanel | 1 Cpanel | 2023-08-08 | 7.5 High |
| cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | ||||
| CVE-2023-29489 | 1 Cpanel | 1 Cpanel | 2023-05-05 | 6.1 Medium |
| An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | ||||
| CVE-2005-2021 | 1 Cpanel | 1 Cpanel | 2022-10-03 | N/A |
| Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page. | ||||
| CVE-2006-5014 | 1 Cpanel | 1 Cpanel | 2022-10-03 | N/A |
| Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2) hooksadmin. | ||||
| CVE-2021-38587 | 1 Cpanel | 1 Cpanel | 2022-07-12 | 7.5 High |
| In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | ||||
| CVE-2021-38590 | 1 Cpanel | 1 Cpanel | 2022-05-03 | 5.5 Medium |
| In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | ||||
| CVE-2020-29136 | 1 Cpanel | 1 Cpanel | 2022-04-26 | 6.5 Medium |
| In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). | ||||
| CVE-2021-38584 | 1 Cpanel | 1 Cpanel | 2021-08-20 | 7.2 High |
| The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | ||||
| CVE-2021-38585 | 1 Cpanel | 1 Cpanel | 2021-08-20 | 7.2 High |
| The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). | ||||
| CVE-2021-38589 | 1 Cpanel | 1 Cpanel | 2021-08-20 | 8.1 High |
| In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | ||||
| CVE-2021-38588 | 1 Cpanel | 1 Cpanel | 2021-08-20 | 8.1 High |
| In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | ||||
| CVE-2021-38586 | 1 Cpanel | 1 Cpanel | 2021-08-20 | 4.4 Medium |
| In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | ||||
| CVE-2020-10117 | 1 Cpanel | 1 Cpanel | 2021-07-21 | 9.1 Critical |
| cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). | ||||
| CVE-2020-10120 | 1 Cpanel | 1 Cpanel | 2021-07-21 | 7.2 High |
| cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). | ||||
| CVE-2020-10115 | 1 Cpanel | 1 Cpanel | 2021-07-21 | 7.2 High |
| cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537). | ||||
| CVE-2020-10116 | 1 Cpanel | 1 Cpanel | 2021-07-21 | 5.3 Medium |
| cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). | ||||