Cpanel

CVEs (424)

• CVE-2019-14390MedJul 30, 2019
  CPanel

  Cpanel
  risk 0.35cvss 5.4epss 0.01

  cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).

• CVE-2019-14386MedJul 30, 2019
  CPanel

  Cpanel
  risk 0.35cvss 5.4epss 0.01

  cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).

• CVE-2017-11441MedJul 19, 2017
  CPanel

  Whm
  risk 0.35cvss 5.4epss 0.01

  The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297.

• CVE-2018-20886MedAug 1, 2019
  CPanel

  Cpanel
  risk 0.34cvss 5.3epss 0.00

  cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

• CVE-2019-14393MedJul 30, 2019
  CPanel

  Cpanel
  risk 0.34cvss 5.3epss 0.00

  cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).

• CVE-2017-18441MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.33cvss 5.0epss 0.01

  cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

• CVE-2017-18464MedAug 5, 2019
  CPanel

  Cpanel
  risk 0.32cvss 4.9epss 0.01

  cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).

• CVE-2017-18453MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.32cvss 4.9epss 0.01

  cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

• CVE-2018-20913MedAug 1, 2019
  CPanel

  Cpanel
  risk 0.32cvss 4.9epss 0.01

  cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).

• CVE-2017-18430MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.31cvss 4.7epss 0.01

  In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).

• CVE-2017-18407MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.31cvss 4.8epss 0.00

  cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

• CVE-2021-38586MedAug 11, 2021
  CPanel

  Cpanel
  risk 0.29cvss 4.4epss 0.00

  In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).

• CVE-2017-18465MedAug 5, 2019
  CPanel

  Cpanel
  risk 0.29cvss 4.4epss 0.00

  cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).

• CVE-2017-18457MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.29cvss 4.4epss 0.00

  cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

• CVE-2017-18450MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.29cvss 4.5epss 0.00

  cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).

• CVE-2017-18437MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.29cvss 4.4epss 0.00

  cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

• CVE-2018-20889MedAug 1, 2019
  CPanel

  Cpanel
  risk 0.29cvss 4.4epss 0.00

  cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

• CVE-2016-10797MedAug 6, 2019
  CPanel

  Cpanel
  risk 0.28cvss 4.3epss 0.00

  cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).

• CVE-2017-18467MedAug 5, 2019
  CPanel

  Cpanel
  risk 0.28cvss 4.3epss 0.01

  cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).

• CVE-2017-18461MedAug 2, 2019
  CPanel

  Cpanel
  risk 0.28cvss 4.3epss 0.01

  cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).