Cpanel
by CPanel
CVEs (424)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14412 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). | ||
| CVE-2019-14410 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). | ||
| CVE-2019-14402 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). | ||
| CVE-2019-14396 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). | ||
| CVE-2019-14395 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). | ||
| CVE-2019-14391 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514). | ||
| CVE-2017-18404 | Low | 0.20 | 3.1 | 0.00 | Aug 2, 2019 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). | ||
| CVE-2017-18466 | Low | 0.18 | 2.7 | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). | ||
| CVE-2017-18455 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). | ||
| CVE-2017-18426 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). | ||
| CVE-2017-18401 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). | ||
| CVE-2017-18395 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 does not block a username of ssl (SEC-328). | ||
| CVE-2017-18394 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). | ||
| CVE-2017-18393 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). | ||
| CVE-2017-18382 | Low | 0.18 | 2.7 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). | ||
| CVE-2018-20938 | Low | 0.18 | 2.7 | 0.01 | Aug 1, 2019 | cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). | ||
| CVE-2018-20932 | Low | 0.18 | 2.7 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406). | ||
| CVE-2018-20897 | Low | 0.18 | 2.8 | 0.00 | Aug 1, 2019 | cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). | ||
| CVE-2019-14407 | Low | 0.18 | 2.7 | 0.01 | Jul 30, 2019 | cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). | ||
| CVE-2017-18428 | Low | 0.16 | 2.5 | 0.00 | Aug 2, 2019 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). |
- risk 0.21cvss 3.3epss 0.00
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
- risk 0.21cvss 3.3epss 0.00
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
- risk 0.21cvss 3.3epss 0.00
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
- risk 0.21cvss 3.3epss 0.00
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
- risk 0.21cvss 3.3epss 0.00
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
- risk 0.21cvss 3.3epss 0.00
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
- risk 0.20cvss 3.1epss 0.00
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
- risk 0.18cvss 2.7epss 0.01
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
- risk 0.18cvss 2.7epss 0.01
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
- risk 0.18cvss 2.7epss 0.01
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
- risk 0.18cvss 2.7epss 0.01
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
- risk 0.18cvss 2.7epss 0.01
cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
- risk 0.18cvss 2.8epss 0.00
cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).
- risk 0.18cvss 2.7epss 0.01
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
- risk 0.16cvss 2.5epss 0.00
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
Page 19 of 22