Browse CVEs

MEDIUM 5.4 CVE-2018-20905 cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). Cpanel 62.0.47 / 68.0.39+ Fix from $1,6002019-08-01 CRITICAL 9.8 CVE-2016-10855 cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $2,3002019-08-01 CRITICAL 9.8 CVE-2016-10858 cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). Cpanel 11.48.4.8 / 11.50.3.1+ Fix from $2,3002019-08-01 HIGH 8.8 CVE-2016-10850 cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10859 cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65). Cpanel 11.48.4.8 / 11.50.3.1+ Fix from $1,9502019-08-01 HIGH 8.1 CVE-2016-10860 cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). Cpanel 11.48.4.8 / 11.50.3.1+ Fix from $1,9502019-08-01 HIGH 7.5 CVE-2015-9291 cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). Cpanel 11.52.0.13+ Fix from $1,9502019-08-01 MEDIUM 6.5 CVE-2016-10852 cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10856 cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). Cpanel 11.48.4.8 / 11.50.3.1+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2016-10857 cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). Cpanel 11.48.4.8 / 11.50.3.1+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20901 cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400). Cpanel 71.9980.37+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10851 cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10853 cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86). Cpanel 11.48.4.8 / 11.54.0.4+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2016-10854 cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). Cpanel 11.48.5.2 / 11.50.4.3+ Fix from $1,6002019-08-01 MEDIUM 6.1 CVE-2018-20900 cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399). Cpanel 62.0.47 / 68.0.39+ Fix from $1,6002019-08-01 HIGH 7.2 CVE-2018-20895 In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393). Cpanel 68.0.39 / 70.0.43+ Fix from $1,9502019-08-01 MEDIUM 6.1 CVE-2018-20899 cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398). Cpanel 62.0.47 / 68.0.39+ Fix from $1,6002019-08-01 MEDIUM 5.5 CVE-2018-20891 cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436). Cpanel 70.0.53 / 72.0.10+ Fix from $1,6002019-08-01 CRITICAL 9.8 CVE-2018-20887 cPanel before 74.0.0 allows SQL injection during database backups (SEC-420). Cpanel 74.0.0+ Fix from $2,3002019-08-01 MEDIUM 5.5 CVE-2018-20888 cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). Cpanel 70.0.53 / 72.0.10+ Fix from $1,6002019-08-01 MEDIUM 5.3 CVE-2018-20886 cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418). Cpanel 70.0.53 / 72.0.10+ Fix from $1,6002019-08-01 MEDIUM 6.5 CVE-2018-20883 cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20884 cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367). Cpanel 74.0.0+ Fix from $1,6002019-08-01 MEDIUM 5.3 CVE-2018-20885 cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416). Cpanel 74.0.0+ Fix from $1,6002019-08-01 MEDIUM 6.8 CVE-2018-20882 cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447). Cpanel 70.0.57 / 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 6.3 CVE-2018-20879 cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20874 cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428). Cpanel 70.0.57 / 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20875 cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20876 cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434). Cpanel 74.0.8+ Fix from $1,6002019-08-01 MEDIUM 5.4 CVE-2018-20877 cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437). Cpanel 74.0.8+ Fix from $1,6002019-08-01