Cpanel
by CPanel
CVEs (413)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18453 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). | |||
| CVE-2017-18452 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). | |||
| CVE-2017-18451 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). | |||
| CVE-2017-18450 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). | |||
| CVE-2017-18449 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). | |||
| CVE-2017-18448 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). | |||
| CVE-2017-18447 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). | |||
| CVE-2017-18446 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). | |||
| CVE-2017-18445 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). | |||
| CVE-2017-18444 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). | |||
| CVE-2017-18443 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). | |||
| CVE-2017-18442 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). | |||
| CVE-2017-18441 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). | |||
| CVE-2017-18440 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). | |||
| CVE-2017-18439 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). | |||
| CVE-2017-18438 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). | |||
| CVE-2017-18437 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). | |||
| CVE-2017-18436 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). | |||
| CVE-2017-18435 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). | |||
| CVE-2017-18434 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
- CVE-2017-18453Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
- CVE-2017-18452Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
- CVE-2017-18451Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
- CVE-2017-18450Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
- CVE-2017-18449Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
- CVE-2017-18448Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
- CVE-2017-18447Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
- CVE-2017-18446Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
- CVE-2017-18445Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
- CVE-2017-18444Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
- CVE-2017-18443Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
- CVE-2017-18442Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
- CVE-2017-18441Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
- CVE-2017-18440Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
- CVE-2017-18439Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
- CVE-2017-18438Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
- CVE-2017-18437Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
- CVE-2017-18436Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
- CVE-2017-18435Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
- CVE-2017-18434Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
Page 9 of 21