Filters
Cpanel CpanelThe WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
7.2
First published (updated )
Cpanel CpanelIn cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
4.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelIn cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587)…
8.1
First published (updated )
Cpanel CpanelIn cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of file…
8.1
First published (updated )
Cpanel CpanelIn cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
5.5
First published (updated )
Cpanel CpanelcPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (…
7.5
First published (updated )
Cpanel CpanelIn cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
6.5
First published (updated )
Cpanel CpanelcPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
4.1
First published (updated )
Cpanel CpanelcPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
9.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
7.5
First published (updated )
Cpanel Cpanelchsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
9.8
First published (updated )
Cpanel CpanelIn cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
9.8
First published (updated )
Cpanel CpanelIn cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-5…
7.5
First published (updated )
Cpanel CpanelIn cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelIn cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
7.5
First published (updated )
Cpanel CpanelIn cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
9.8
First published (updated )
Cpanel CpanelcPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-55…
7.5
First published (updated )
Cpanel CpanelcPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
7.5
First published (updated )
Cpanel CpanelcPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
9.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package mod…
7.5
First published (updated )
Cpanel CpanelThe email quota cache in cPanel before 90.0.10 allows overwriting of files.
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 86.0.14 allows attackers to obtain access to the current working directory via the acc…
8.1
First published (updated )
Cpanel CpanelcPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings…
5.3
First published (updated )
Cpanel CpanelcPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
6.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-54…
9.8
First published (updated )
Cpanel CpanelcPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync s…
First published (updated )
Cpanel CpanelcPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shel…
9.8
First published (updated )
Cpanel CpanelcPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
9.1
First published (updated )
Cpanel CpanelcPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
9.1
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts…
5.3
First published (updated )
Cpanel CpanelcPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. …
First published (updated )
Cpanel CpanelcPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is in…
9.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Cpanel CpanelcPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log proc…
5.5
First published (updated )
Cpanel CpanelcPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-5…
6.5
First published (updated )
Cpanel CpanelIn cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
3.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.