CPanel

cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).

cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).

cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).

In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).

In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).

cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).

cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).

cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE…

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).

cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).