Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vec…
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).