Vendor CVEs
CPanel
All CVEs
436 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18481 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211). | |||
| CVE-2017-18480 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210). | |||
| CVE-2017-18479 | 0.00 | — | 0.00 | Aug 5, 2019 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). | |||
| CVE-2017-18478 | 0.00 | — | 0.01 | Aug 5, 2019 | In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). | |||
| CVE-2017-18477 | 0.00 | — | 0.01 | Aug 5, 2019 | In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206). | |||
| CVE-2017-18476 | 0.00 | — | 0.01 | Aug 5, 2019 | Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). | |||
| CVE-2017-18475 | 0.00 | — | 0.01 | Aug 5, 2019 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). | |||
| CVE-2017-18474 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). | |||
| CVE-2017-18473 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199). | |||
| CVE-2017-18472 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). | |||
| CVE-2017-18471 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197). | |||
| CVE-2017-18470 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). | |||
| CVE-2017-18469 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). | |||
| CVE-2017-18468 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). | |||
| CVE-2017-18467 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229). | |||
| CVE-2017-18465 | 0.00 | — | 0.00 | Aug 5, 2019 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). | |||
| CVE-2017-18466 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). | |||
| CVE-2017-18464 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). | |||
| CVE-2017-18462 | 0.00 | — | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224). | |||
| CVE-2017-18463 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). | |||
| CVE-2017-18461 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). | |||
| CVE-2017-18460 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). | |||
| CVE-2017-18459 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). | |||
| CVE-2017-18458 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). | |||
| CVE-2017-18457 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). | |||
| CVE-2017-18456 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). | |||
| CVE-2017-18455 | 0.00 | — | 0.01 | Aug 2, 2019 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). | |||
| CVE-2017-18454 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). | |||
| CVE-2017-18453 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). | |||
| CVE-2017-18452 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). | |||
| CVE-2017-18451 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). | |||
| CVE-2017-18450 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). | |||
| CVE-2017-18449 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). | |||
| CVE-2017-18448 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). | |||
| CVE-2017-18447 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). | |||
| CVE-2017-18446 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). | |||
| CVE-2017-18445 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). | |||
| CVE-2017-18444 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). | |||
| CVE-2017-18443 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). | |||
| CVE-2017-18442 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). | |||
| CVE-2017-18441 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). | |||
| CVE-2017-18440 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). | |||
| CVE-2017-18439 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). | |||
| CVE-2017-18438 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). | |||
| CVE-2017-18437 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). | |||
| CVE-2017-18436 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). | |||
| CVE-2017-18435 | 0.00 | — | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). | |||
| CVE-2017-18434 | 0.00 | — | 0.00 | Aug 2, 2019 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). | |||
| CVE-2017-18433 | 0.00 | — | 0.02 | Aug 2, 2019 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). | |||
| CVE-2017-18432 | 0.00 | — | 0.00 | Aug 2, 2019 | In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). |
- CVE-2017-18481Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
- CVE-2017-18480Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
- CVE-2017-18479Aug 5, 2019risk 0.00cvss —epss 0.00
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
- CVE-2017-18478Aug 5, 2019risk 0.00cvss —epss 0.01
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
- CVE-2017-18477Aug 5, 2019risk 0.00cvss —epss 0.01
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
- CVE-2017-18476Aug 5, 2019risk 0.00cvss —epss 0.01
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
- CVE-2017-18475Aug 5, 2019risk 0.00cvss —epss 0.01
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
- CVE-2017-18474Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
- CVE-2017-18473Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
- CVE-2017-18472Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
- CVE-2017-18471Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
- CVE-2017-18470Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
- CVE-2017-18469Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
- CVE-2017-18468Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
- CVE-2017-18467Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
- CVE-2017-18465Aug 5, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
- CVE-2017-18466Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
- CVE-2017-18464Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
- CVE-2017-18462Aug 5, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
- CVE-2017-18463Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
- CVE-2017-18461Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
- CVE-2017-18460Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).
- CVE-2017-18459Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).
- CVE-2017-18458Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
- CVE-2017-18457Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
- CVE-2017-18456Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
- CVE-2017-18455Aug 2, 2019risk 0.00cvss —epss 0.01
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
- CVE-2017-18454Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
- CVE-2017-18453Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
- CVE-2017-18452Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
- CVE-2017-18451Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
- CVE-2017-18450Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
- CVE-2017-18449Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
- CVE-2017-18448Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
- CVE-2017-18447Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
- CVE-2017-18446Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
- CVE-2017-18445Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
- CVE-2017-18444Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
- CVE-2017-18443Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
- CVE-2017-18442Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
- CVE-2017-18441Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
- CVE-2017-18440Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
- CVE-2017-18439Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
- CVE-2017-18438Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
- CVE-2017-18437Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
- CVE-2017-18436Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
- CVE-2017-18435Aug 2, 2019risk 0.00cvss —epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
- CVE-2017-18434Aug 2, 2019risk 0.00cvss —epss 0.00
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
- CVE-2017-18433Aug 2, 2019risk 0.00cvss —epss 0.02
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
- CVE-2017-18432Aug 2, 2019risk 0.00cvss —epss 0.00
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
Page 4 of 9