Browse CVEs

MEDIUM 6.5 CVE-2018-20930 cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 6.3 CVE-2018-20931 cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20928 cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20929 cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20924 cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378). Cpanel 62.0.42 / 68.0.33+ Fix from $1,6002019-08-01 HIGH 8.8 CVE-2016-10840 cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10839 cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10843 cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 7.5 CVE-2016-10837 cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 MEDIUM 6.5 CVE-2016-10836 cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). Cpanel 11.50.5.2 / 11.52.4.1+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10838 cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10842 cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 5.3 CVE-2016-10841 The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20918 cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20919 cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20920 cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20921 cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20922 cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20923 cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20917 cPanel before 70.0.23 allows any user to disable Solr (SEC-371). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20915 cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20916 cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370). Cpanel 70.0.23+ Fix from $1,6002019-08-01 HIGH 7.3 CVE-2018-20914 In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368). Cpanel 70.0.23+ Fix from $1,9502019-08-01 HIGH 7.2 CVE-2018-20911 cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359). Cpanel 70.0.23+ Fix from $1,9502019-08-01 HIGH 7.1 CVE-2018-20909 cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). Cpanel 62.0.42 / 68.0.33+ Fix from $1,9502019-08-01 MEDIUM 6.3 CVE-2018-20912 cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20903 cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421). Cpanel 71.9980.37+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20910 cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357). Cpanel 70.0.23+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20902 cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408). Cpanel 71.9980.37+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20908 cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). Cpanel 62.0.47 / 68.0.39+ Fix from $1,6002019-08-01