Cpanel : Security Vulnerabilities, CVEs, CVSS score >= 7
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
Max CVSS
8.1
EPSS Score
0.08%
Published
2021-08-11
Updated
2021-08-20
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
Max CVSS
8.1
EPSS Score
0.20%
Published
2021-08-11
Updated
2021-08-20
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
Max CVSS
7.5
EPSS Score
0.07%
Published
2021-08-11
Updated
2022-07-12
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
Max CVSS
7.2
EPSS Score
0.10%
Published
2021-08-11
Updated
2021-08-20
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
Max CVSS
7.2
EPSS Score
0.10%
Published
2021-08-11
Updated
2021-08-20
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
Max CVSS
7.5
EPSS Score
0.08%
Published
2021-01-26
Updated
2021-02-03
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
Max CVSS
7.5
EPSS Score
0.08%
Published
2021-01-26
Updated
2021-02-03
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
Max CVSS
7.5
EPSS Score
0.08%
Published
2020-09-25
Updated
2020-09-29
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
Max CVSS
7.5
EPSS Score
0.08%
Published
2020-09-25
Updated
2020-09-29
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
Max CVSS
9.8
EPSS Score
0.43%
Published
2020-09-25
Updated
2020-09-29
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-09-25
Updated
2021-07-21
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-09-25
Updated
2021-07-21
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
Max CVSS
9.8
EPSS Score
0.31%
Published
2020-09-25
Updated
2021-07-21
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-09-25
Updated
2020-09-29
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-09-25
Updated
2020-09-29
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-09-25
Updated
2021-07-21
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
Max CVSS
9.8
EPSS Score
0.31%
Published
2020-09-25
Updated
2021-07-21
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
Max CVSS
9.8
EPSS Score
0.22%
Published
2020-09-25
Updated
2020-09-29
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
Max CVSS
7.5
EPSS Score
0.08%
Published
2020-09-25
Updated
2020-09-29
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
Max CVSS
9.8
EPSS Score
0.65%
Published
2020-09-25
Updated
2020-09-29
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
Max CVSS
8.1
EPSS Score
0.07%
Published
2020-05-11
Updated
2021-07-21
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
Max CVSS
9.8
EPSS Score
0.43%
Published
2020-03-17
Updated
2020-03-19
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
Max CVSS
9.0
EPSS Score
0.44%
Published
2020-03-17
Updated
2021-07-21
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
Max CVSS
9.8
EPSS Score
1.00%
Published
2020-03-17
Updated
2020-03-19
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
Max CVSS
9.1
EPSS Score
0.17%
Published
2020-03-17
Updated
2020-03-19