Cpanel
by CPanel
CVEs (413)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-26266 | 0.00 | — | 0.01 | Jan 26, 2021 | cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). | |||
| CVE-2021-26267 | 0.00 | — | 0.01 | Jan 26, 2021 | cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | |||
| CVE-2020-29136 | 0.00 | — | 0.01 | Nov 27, 2020 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). | |||
| CVE-2020-29135 | 0.00 | — | 0.01 | Nov 27, 2020 | cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). | |||
| CVE-2020-26099 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). | |||
| CVE-2020-26100 | 0.00 | — | 0.02 | Sep 25, 2020 | chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). | |||
| CVE-2020-26101 | 0.00 | — | 0.01 | Sep 25, 2020 | In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). | |||
| CVE-2020-26102 | 0.00 | — | 0.01 | Sep 25, 2020 | In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). | |||
| CVE-2020-26103 | 0.00 | — | 0.01 | Sep 25, 2020 | In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). | |||
| CVE-2020-26104 | 0.00 | — | 0.01 | Sep 25, 2020 | In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). | |||
| CVE-2020-26105 | 0.00 | — | 0.01 | Sep 25, 2020 | In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). | |||
| CVE-2020-26106 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). | |||
| CVE-2020-26107 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). | |||
| CVE-2020-26108 | 0.00 | — | 0.02 | Sep 25, 2020 | cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). | |||
| CVE-2020-26109 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). | |||
| CVE-2020-26110 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). | |||
| CVE-2020-26111 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). | |||
| CVE-2020-26112 | 0.00 | — | 0.01 | Sep 25, 2020 | The email quota cache in cPanel before 90.0.10 allows overwriting of files. | |||
| CVE-2020-26113 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). | |||
| CVE-2020-26114 | 0.00 | — | 0.01 | Sep 25, 2020 | cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). |
- CVE-2021-26266Jan 26, 2021risk 0.00cvss —epss 0.01
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
- CVE-2021-26267Jan 26, 2021risk 0.00cvss —epss 0.01
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
- CVE-2020-29136Nov 27, 2020risk 0.00cvss —epss 0.01
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
- CVE-2020-29135Nov 27, 2020risk 0.00cvss —epss 0.01
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
- CVE-2020-26099Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
- CVE-2020-26100Sep 25, 2020risk 0.00cvss —epss 0.02
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
- CVE-2020-26101Sep 25, 2020risk 0.00cvss —epss 0.01
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
- CVE-2020-26102Sep 25, 2020risk 0.00cvss —epss 0.01
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
- CVE-2020-26103Sep 25, 2020risk 0.00cvss —epss 0.01
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
- CVE-2020-26104Sep 25, 2020risk 0.00cvss —epss 0.01
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
- CVE-2020-26105Sep 25, 2020risk 0.00cvss —epss 0.01
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
- CVE-2020-26106Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
- CVE-2020-26107Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
- CVE-2020-26108Sep 25, 2020risk 0.00cvss —epss 0.02
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
- CVE-2020-26109Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
- CVE-2020-26110Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
- CVE-2020-26111Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
- CVE-2020-26112Sep 25, 2020risk 0.00cvss —epss 0.01
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
- CVE-2020-26113Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
- CVE-2020-26114Sep 25, 2020risk 0.00cvss —epss 0.01
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
Page 3 of 21