Browse CVEs

MEDIUM 5.4 CVE-2018-20878 cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20881 cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2019-14409 cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). Cpanel 78.0.2+ Fix from $1,6002019-07-30 MEDIUM 5.3 CVE-2019-14411 cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). Cpanel 78.0.2+ Fix from $1,6002019-07-30 HIGH 8.8 CVE-2019-14398 cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). Cpanel 80.0.5+ Fix from $1,9502019-07-30 HIGH 8.8 CVE-2019-14401 cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). Cpanel 78.0.18+ Fix from $1,9502019-07-30 HIGH 8.8 CVE-2019-14405 cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). Cpanel 78.0.18+ Fix from $1,9502019-07-30 HIGH 7.8 CVE-2019-14400 cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). Cpanel 78.0.18+ Fix from $1,9502019-07-30 HIGH 7.1 CVE-2019-14399 The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). Cpanel 78.0.18+ Fix from $1,9502019-07-30 MEDIUM 6.1 CVE-2019-14406 cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). Cpanel 78.0.18+ Fix from $1,6002019-07-30 MEDIUM 5.5 CVE-2018-20870 The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). Cpanel 76.0.8+ Fix from $1,6002019-07-30 MEDIUM 5.5 CVE-2019-14394 cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). Cpanel 80.0.5+ Fix from $1,6002019-07-30 MEDIUM 5.5 CVE-2019-14404 cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Cpanel 78.0.18+ Fix from $1,6002019-07-30 MEDIUM 5.3 CVE-2019-14393 cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486). Cpanel 80.0.5+ Fix from $1,6002019-07-30 MEDIUM 5.3 CVE-2019-14397 cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). Cpanel 80.0.5+ Fix from $1,6002019-07-30 CRITICAL 9.8 CVE-2018-20863 cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). Cpanel 76.0.8+ Fix from $2,3002019-07-30 HIGH 7.8 CVE-2018-20862 cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366). Cpanel 76.0.8+ Fix from $1,9502019-07-30 HIGH 7.8 CVE-2018-20869 cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). Cpanel 76.0.8+ Fix from $1,9502019-07-30 MEDIUM 6.5 CVE-2018-20864 cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). Cpanel 76.0.8+ Fix from $1,6002019-07-30 MEDIUM 6.1 CVE-2018-20865 cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). Cpanel 76.0.8+ Fix from $1,6002019-07-30 MEDIUM 6.1 CVE-2018-20866 cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). Cpanel 76.0.8+ Fix from $1,6002019-07-30 MEDIUM 6.1 CVE-2018-20868 cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). Cpanel 76.0.8+ Fix from $1,6002019-07-30 HIGH 8.8 CVE-2019-14392 cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501). Cpanel 80.0.22+ Fix from $1,9502019-07-30 MEDIUM 6.1 CVE-2018-20867 cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462). Cpanel 76.0.8+ Fix from $1,6002019-07-30 HIGH 7.8 CVE-2019-14389 cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510). Cpanel 82.0.2+ Fix from $1,9502019-07-30 HIGH 7.5 CVE-2019-14388 cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507). Cpanel 82.0.2+ Fix from $1,9502019-07-30 MEDIUM 6.1 CVE-2019-14387 cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506). Cpanel 82.0.2+ Fix from $1,6002019-07-30 MEDIUM 5.4 CVE-2019-14386 cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504). Cpanel 82.0.2+ Fix from $1,6002019-07-30 MEDIUM 5.4 CVE-2019-14390 cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512). Cpanel 82.0.2+ Fix from $1,6002019-07-30 MEDIUM 6.1 CVE-2018-16236 cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/TH… Cpanel after 74 Fix from $1,6002018-08-30