Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Wp Squared
HIGH 8.2
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credenti…
Wp Squared
HIGH 8.6
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoin…
Wp Squared
CRITICAL 9.8
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to …
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitra…
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed ve…
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).