Browse CVEs

MEDIUM 6.1 CVE-2018-20949 cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20950 cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20951 cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20953 cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 HIGH 8.8 CVE-2016-10834 cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 MEDIUM 5.7 CVE-2018-20945 bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 MEDIUM 5.6 CVE-2018-20941 cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349). Cpanel 68.0.27+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20947 cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356). Cpanel 62.0.39 / 66.0.35+ Fix from $1,6002019-08-01 CRITICAL 9.8 CVE-2016-10824 cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $2,3002019-08-01 HIGH 8.8 CVE-2016-10823 cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 8.8 CVE-2016-10828 cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10825 cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10830 cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 7.5 CVE-2016-10833 cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,9502019-08-01 HIGH 7.2 CVE-2016-10831 cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). Cpanel 11.54.0.20 / 55.9999.141+ Fix from $1,9502019-08-01 MEDIUM 6.5 CVE-2016-10829 cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10832 cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10822 cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10827 cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2018-20934 cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20933 cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20935 cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 HIGH 8.1 CVE-2016-10845 cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10846 cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10847 cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 7.2 CVE-2016-10848 cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 MEDIUM 6.7 CVE-2018-20925 cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 6.7 CVE-2018-20926 cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10844 The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10849 cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01