Browse CVEs

CRITICAL 9.8 CVE-2020-26100 chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Cpanel 88.0.3+ Fix from $2,3002020-09-25 CRITICAL 9.8 CVE-2020-26101 In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Cpanel 88.0.3+ Fix from $2,3002020-09-25 HIGH 7.5 CVE-2020-26099 cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26102 In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 8.1 CVE-2020-12785 cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540). Cpanel 11.78.0.47 / 11.84.0.22+ Fix from $1,9502020-05-11 MEDIUM 5.3 CVE-2020-12784 cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505). Cpanel 11.78.0.47 / 11.84.0.22+ Fix from $1,6002020-05-11 CRITICAL 9.8 CVE-2020-10121 cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Cpanel 78.0.45 / 84.0.20+ Fix from $2,3002020-03-17 HIGH 7.2 CVE-2020-10120 cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). Cpanel 84.0.20+ Fix from $1,9502020-03-17 MEDIUM 6.5 CVE-2020-10122 cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). Cpanel 78.0.45 / 84.0.20+ Fix from $1,6002020-03-17 CRITICAL 9.8 CVE-2019-20498 cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534). Cpanel 78.0.43 / 82.0.18+ Fix from $2,3002020-03-17 CRITICAL 9.8 CVE-2020-10119 cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Cpanel 84.0.20+ Fix from $2,3002020-03-17 CRITICAL 9.1 CVE-2020-10117 cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Cpanel 78.0.45 / 84.0.20+ Fix from $2,3002020-03-17 CRITICAL 9.1 CVE-2020-10118 cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Cpanel 78.0.45 / 84.0.20+ Fix from $2,3002020-03-17 HIGH 7.2 CVE-2020-10115 cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537). Cpanel 78.0.45 / 84.0.20+ Fix from $1,9502020-03-17 MEDIUM 6.5 CVE-2019-20495 cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531). Cpanel 82.0.18 / 84.0.10+ Fix from $1,6002020-03-17 MEDIUM 6.1 CVE-2020-10113 cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). Cpanel 78.0.45 / 84.0.20+ Fix from $1,6002020-03-17 MEDIUM 6.1 CVE-2020-10114 cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). Cpanel 78.0.45 / 84.0.20+ Fix from $1,6002020-03-17 MEDIUM 5.5 CVE-2019-20496 cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532). Cpanel 78.0.43 / 82.0.18+ Fix from $1,6002020-03-17 MEDIUM 5.4 CVE-2019-20497 cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533). Cpanel 78.0.43 / 82.0.18+ Fix from $1,6002020-03-17 MEDIUM 5.3 CVE-2020-10116 cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). Cpanel 78.0.45 / 84.0.20+ Fix from $1,6002020-03-17 HIGH 8.8 CVE-2019-20490 cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499). Cpanel 78.0.43 / 82.0.18+ Fix from $1,9502020-03-17 HIGH 8.8 CVE-2019-20492 cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516). Cpanel 78.0.43 / 82.0.18+ Fix from $1,9502020-03-17 MEDIUM 6.1 CVE-2019-20493 cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520). Cpanel 78.0.43 / 82.0.18+ Fix from $1,6002020-03-17 MEDIUM 5.4 CVE-2019-20491 cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508). Cpanel 78.0.43 / 82.0.18+ Fix from $1,6002020-03-16 MEDIUM 5.4 CVE-2012-6449 The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability. Cpanel No fix yet Fix from $1,6002020-02-10 MEDIUM 6.1 CVE-2012-6448 Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vec… Webhost Manager No fix yet Fix from $1,6002020-01-27 HIGH 8.8 CVE-2019-17375 cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). Cpanel 82.0.15+ Fix from $1,9502019-10-09 MEDIUM 6.1 CVE-2019-17376 cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). Cpanel 78.0.39 / 82.0.15+ Fix from $1,6002019-10-09 MEDIUM 6.1 CVE-2019-17377 cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). Cpanel 78.0.39 / 82.0.15+ Fix from $1,6002019-10-09 MEDIUM 6.1 CVE-2019-17378 cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). Cpanel 78.0.39 / 82.0.15+ Fix from $1,6002019-10-09