CPanel

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).

cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).

cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).

Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).

cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).

cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).

cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).

cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).

cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).

cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).

The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380).

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379).

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).

Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it…

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).

cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).

cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).

cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).

cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).

cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).

In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).