CPanel

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).

cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2) hooksadmin.

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled…

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).

In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).

In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).

In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).

In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).

cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

cPanel before 58.0.4 has improper session handling for shared users (SEC-139).

cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).

cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).

cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).

In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).

cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).

cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).

cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).

cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).

cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).

cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).