Browse CVEs

HIGH 7.4 CVE-2017-18414 cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). Cpanel 56.0.52 / 60.0.48+ Fix from $1,9502019-08-02 MEDIUM 6.8 CVE-2017-18411 The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). Cpanel 56.0.52 / 60.0.48+ Fix from $1,6002019-08-02 MEDIUM 6.5 CVE-2017-18409 In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). Cpanel 56.0.52 / 60.0.48+ Fix from $1,6002019-08-02 MEDIUM 6.5 CVE-2017-18410 In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). Cpanel 56.0.52 / 60.0.48+ Fix from $1,6002019-08-02 MEDIUM 6.3 CVE-2017-18403 cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). Cpanel 62.0.35 / 64.0.42+ Fix from $1,6002019-08-02 MEDIUM 5.5 CVE-2017-18405 cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). Cpanel 62.0.35 / 64.0.42+ Fix from $1,6002019-08-02 MEDIUM 5.5 CVE-2017-18416 cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). Cpanel 56.0.52 / 60.0.48+ Fix from $1,6002019-08-02 MEDIUM 5.4 CVE-2017-18408 cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). Cpanel 56.0.52 / 60.0.48+ Fix from $1,6002019-08-02 HIGH 7.8 CVE-2017-18400 cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 MEDIUM 5.5 CVE-2017-18396 cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). Cpanel 62.0.35 / 64.0.42+ Fix from $1,6002019-08-02 MEDIUM 5.4 CVE-2017-18402 cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336). Cpanel 62.0.35 / 64.0.42+ Fix from $1,6002019-08-02 HIGH 7.8 CVE-2017-18383 cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 HIGH 7.8 CVE-2017-18388 cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 HIGH 7.8 CVE-2017-18390 cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 HIGH 7.2 CVE-2017-18386 cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 HIGH 7.2 CVE-2017-18387 cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). Cpanel 62.0.35 / 64.0.42+ Fix from $1,9502019-08-02 MEDIUM 6.3 CVE-2017-18389 cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). Cpanel 64.0.42 / 66.0.34+ Fix from $1,6002019-08-02 MEDIUM 5.5 CVE-2017-18385 cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). Cpanel 62.0.35 / 64.0.42+ Fix from $1,6002019-08-02 HIGH 8.8 CVE-2016-10820 cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 8.8 CVE-2016-10826 cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 MEDIUM 6.5 CVE-2016-10821 In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 CRITICAL 9.8 CVE-2016-10817 cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). Cpanel 11.50.6.2 / 11.52.6.1+ Fix from $2,3002019-08-01 HIGH 8.8 CVE-2016-10814 cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). Cpanel 11.50.6.2 / 11.52.6.1+ Fix from $1,9502019-08-01 HIGH 8.8 CVE-2016-10816 cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). Cpanel 11.50.6.2 / 11.52.6.1+ Fix from $1,9502019-08-01 MEDIUM 6.5 CVE-2016-10815 cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). Cpanel 11.50.6.2 / 11.52.6.1+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10818 cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). Cpanel 56.0.15+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10819 In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). Cpanel 11.50.6.2 / 11.52.6.1+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10813 cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). Cpanel 11.54.0.24 / 56.0.15+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2018-20952 cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20948 cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01