Vendor CVEs
CPanel
All CVEs
436 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17377 | 0.00 | — | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). | |||
| CVE-2019-17376 | 0.00 | — | 0.00 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). | |||
| CVE-2019-17375 | 0.00 | — | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). | |||
| CVE-2016-10812 | 0.00 | — | 0.01 | Aug 7, 2019 | In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). | |||
| CVE-2016-10811 | 0.00 | — | 0.01 | Aug 7, 2019 | In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). | |||
| CVE-2016-10810 | 0.00 | — | 0.01 | Aug 7, 2019 | In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115). | |||
| CVE-2016-10809 | 0.00 | — | 0.01 | Aug 7, 2019 | In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). | |||
| CVE-2016-10808 | 0.00 | — | 0.01 | Aug 7, 2019 | In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). | |||
| CVE-2016-10807 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). | |||
| CVE-2016-10806 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110). | |||
| CVE-2016-10805 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109). | |||
| CVE-2016-10804 | 0.00 | — | 0.01 | Aug 7, 2019 | The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). | |||
| CVE-2016-10803 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). | |||
| CVE-2016-10802 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). | |||
| CVE-2016-10801 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 58.0.4 has improper session handling for shared users (SEC-139). | |||
| CVE-2016-10800 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). | |||
| CVE-2016-10799 | 0.00 | — | 0.00 | Aug 7, 2019 | cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). | |||
| CVE-2016-10798 | 0.00 | — | 0.01 | Aug 7, 2019 | cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134). | |||
| CVE-2016-10797 | 0.00 | — | 0.00 | Aug 6, 2019 | cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133). | |||
| CVE-2016-10796 | 0.00 | — | 0.00 | Aug 6, 2019 | cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130). | |||
| CVE-2016-10795 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156). | |||
| CVE-2016-10794 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154). | |||
| CVE-2016-10793 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152). | |||
| CVE-2016-10792 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141). | |||
| CVE-2016-10791 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559). | |||
| CVE-2016-10790 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192). | |||
| CVE-2016-10789 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191). | |||
| CVE-2016-10788 | 0.00 | — | 0.02 | Aug 6, 2019 | cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188). | |||
| CVE-2016-10787 | 0.00 | — | 0.01 | Aug 6, 2019 | The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187). | |||
| CVE-2016-10786 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186). | |||
| CVE-2016-10785 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185). | |||
| CVE-2016-10784 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184). | |||
| CVE-2016-10783 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182). | |||
| CVE-2016-10782 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181). | |||
| CVE-2016-10781 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180). | |||
| CVE-2016-10780 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180). | |||
| CVE-2016-10779 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179). | |||
| CVE-2016-10777 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177). | |||
| CVE-2016-10778 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178). | |||
| CVE-2016-10776 | 0.00 | — | 0.01 | Aug 6, 2019 | cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174). | |||
| CVE-2016-10775 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). | |||
| CVE-2016-10774 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172). | |||
| CVE-2016-10773 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171). | |||
| CVE-2016-10772 | 0.00 | — | 0.00 | Aug 5, 2019 | cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). | |||
| CVE-2016-10771 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). | |||
| CVE-2016-10770 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). | |||
| CVE-2016-10769 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). | |||
| CVE-2016-10768 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). | |||
| CVE-2016-10767 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). | |||
| CVE-2017-18482 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). |
- CVE-2019-17377Oct 9, 2019risk 0.00cvss —epss 0.01
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
- CVE-2019-17376Oct 9, 2019risk 0.00cvss —epss 0.00
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
- CVE-2019-17375Oct 9, 2019risk 0.00cvss —epss 0.01
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
- CVE-2016-10812Aug 7, 2019risk 0.00cvss —epss 0.01
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
- CVE-2016-10811Aug 7, 2019risk 0.00cvss —epss 0.01
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
- CVE-2016-10810Aug 7, 2019risk 0.00cvss —epss 0.01
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
- CVE-2016-10809Aug 7, 2019risk 0.00cvss —epss 0.01
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
- CVE-2016-10808Aug 7, 2019risk 0.00cvss —epss 0.01
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
- CVE-2016-10807Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
- CVE-2016-10806Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
- CVE-2016-10805Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
- CVE-2016-10804Aug 7, 2019risk 0.00cvss —epss 0.01
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
- CVE-2016-10803Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
- CVE-2016-10802Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
- CVE-2016-10801Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
- CVE-2016-10800Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
- CVE-2016-10799Aug 7, 2019risk 0.00cvss —epss 0.00
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
- CVE-2016-10798Aug 7, 2019risk 0.00cvss —epss 0.01
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
- CVE-2016-10797Aug 6, 2019risk 0.00cvss —epss 0.00
cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).
- CVE-2016-10796Aug 6, 2019risk 0.00cvss —epss 0.00
cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
- CVE-2016-10795Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
- CVE-2016-10794Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).
- CVE-2016-10793Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
- CVE-2016-10792Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
- CVE-2016-10791Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
- CVE-2016-10790Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
- CVE-2016-10789Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).
- CVE-2016-10788Aug 6, 2019risk 0.00cvss —epss 0.02
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
- CVE-2016-10787Aug 6, 2019risk 0.00cvss —epss 0.01
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
- CVE-2016-10786Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
- CVE-2016-10785Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
- CVE-2016-10784Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
- CVE-2016-10783Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
- CVE-2016-10782Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
- CVE-2016-10781Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
- CVE-2016-10780Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
- CVE-2016-10779Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
- CVE-2016-10777Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
- CVE-2016-10778Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
- CVE-2016-10776Aug 6, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
- CVE-2016-10775Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
- CVE-2016-10774Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
- CVE-2016-10773Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
- CVE-2016-10772Aug 5, 2019risk 0.00cvss —epss 0.00
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
- CVE-2016-10771Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
- CVE-2016-10770Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
- CVE-2016-10769Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
- CVE-2016-10768Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
- CVE-2016-10767Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
- CVE-2017-18482Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
Page 3 of 9