CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Cpanel : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2017-18458 20 2019-08-02 2019-08-06
3.6
 None Local Low Not required None Partial Partial
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
152 CVE-2017-18457 284 2019-08-02 2019-08-09
4.9
 None Local Low Not required Complete None None
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
153 CVE-2017-18456 79 XSS 2019-08-02 2019-08-08
4.3
 None Remote Medium Not required None Partial None
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
154 CVE-2017-18455 264 2019-08-02 2019-08-08
4.0
 None Remote Low Single system None None Partial
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
155 CVE-2017-18454 79 XSS 2019-08-02 2019-08-06
3.5
 None Remote Medium Single system None Partial None
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
156 CVE-2017-18453 20 2019-08-02 2019-08-05
4.0
 None Remote Low Single system None Partial None
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
157 CVE-2017-18452 20 Exec Code 2019-08-02 2019-08-14
4.6
 None Local Low Not required Partial Partial Partial
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
158 CVE-2017-18451 264 2019-08-02 2019-08-05
5.0
 None Remote Low Not required Partial None None
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
159 CVE-2017-18450 264 2019-08-02 2019-08-08
4.4
 None Local Medium Not required Partial Partial Partial
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
160 CVE-2017-18449 20 2019-08-02 2019-08-08
2.1
 None Local Low Not required None Partial None
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
161 CVE-2017-18448 22 Dir. Trav. 2019-08-02 2019-08-08
5.0
 None Remote Low Not required Partial None None
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
162 CVE-2017-18447 20 Exec Code 2019-08-02 2019-08-08
6.5
 None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
163 CVE-2017-18446 125 2019-08-02 2019-08-14
6.5
 None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
164 CVE-2017-18445 254 2019-08-02 2019-08-08
4.0
 None Remote Low Single system None Partial None
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
165 CVE-2017-18444 20 Exec Code 2019-08-02 2019-08-08
5.0
 None Remote Low Not required None Partial None
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
166 CVE-2017-18443 20 2019-08-02 2019-08-08
5.0
 None Remote Low Not required None Partial None
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
167 CVE-2017-18442 77 Exec Code 2019-08-02 2019-08-07
5.0
 None Remote Low Not required None Partial None
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
168 CVE-2017-18441 601 2019-08-02 2019-08-07
4.0
 None Remote Low Single system None Partial None
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
169 CVE-2017-18440 20 2019-08-02 2019-08-05
4.0
 None Remote Low Single system Partial None None
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
170 CVE-2017-18439 20 Exec Code 2019-08-02 2019-08-09
6.5
 None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
171 CVE-2017-18438 611 Exec Code 2019-08-02 2019-08-09
6.5
 None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
172 CVE-2017-18437 74 Exec Code 2019-08-02 2019-08-09
3.6
 None Local Low Not required Partial Partial None
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
173 CVE-2017-18436 200 +Info 2019-08-02 2019-08-09
2.7
 None Local Network Low Single system Partial None None
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
174 CVE-2017-18435 434 Exec Code 2019-08-02 2019-08-09
7.5
 None Remote Low Not required Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
175 CVE-2017-18434 20 Exec Code 2019-08-02 2019-08-09
7.2
 None Local Low Not required Complete Complete Complete
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
176 CVE-2017-18433 20 Exec Code 2019-08-02 2019-08-09
9.0
 None Remote Low Single system Complete Complete Complete
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
177 CVE-2017-18432 200 +Info 2019-08-02 2019-08-12
2.1
 None Local Low Not required Partial None None
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
178 CVE-2017-18431 20 2019-08-02 2019-08-13
5.0
 None Remote Low Not required None Partial None
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
179 CVE-2017-18430 20 2019-08-02 2019-08-08
4.6
 None Local Low Not required Partial Partial Partial
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
180 CVE-2017-18429 254 2019-08-02 2019-09-24
2.1
 None Local Low Not required Partial None None
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
181 CVE-2017-18428 200 +Info 2019-08-02 2019-08-12
1.9
 None Local Medium Not required Partial None None
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
182 CVE-2017-18427 275 2019-08-02 2019-08-12
2.1
 None Local Low Not required Partial None None
In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
183 CVE-2017-18426 532 2019-08-02 2019-08-09
4.0
 None Remote Low Single system Partial None None
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
184 CVE-2017-18425 275 2019-08-02 2019-08-09
1.9
 None Local Medium Not required Partial None None
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
185 CVE-2017-18424 200 +Info 2019-08-02 2019-08-05
2.1
 None Local Low Not required Partial None None
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
186 CVE-2017-18423 532 2019-08-02 2019-08-05
2.1
 None Local Low Not required Partial None None
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
187 CVE-2017-18422 275 2019-08-02 2019-08-05
2.1
 None Local Low Not required Partial None None
In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
188 CVE-2017-18421 284 2019-08-02 2019-08-05
2.1
 None Local Low Not required Partial None None
cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
189 CVE-2017-18420 79 XSS 2019-08-02 2019-08-05
3.5
 None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
190 CVE-2017-18419 79 XSS 2019-08-02 2019-08-05
3.5
 None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
191 CVE-2017-18418 79 XSS 2019-08-02 2019-08-05
3.5
 None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
192 CVE-2017-18417 79 XSS 2019-08-02 2019-08-05
3.5
 None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
193 CVE-2017-18416 284 2019-08-02 2019-08-12
3.6
 None Local Low Not required None Partial Partial
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
194 CVE-2017-18415 20 Exec Code 2019-08-02 2019-08-12
4.6
 None Local Low Not required Partial Partial Partial
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
195 CVE-2017-18414 601 2019-08-02 2019-08-12
5.8
 None Remote Medium Not required Partial Partial None
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
196 CVE-2017-18413 264 2019-08-02 2019-08-12
4.6
 None Local Low Not required Partial Partial Partial
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
197 CVE-2017-18412 532 2019-08-02 2019-08-12
1.9
 None Local Medium Not required Partial None None
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
198 CVE-2017-18411 20 2019-08-02 2019-08-12
4.0
 None Remote Low Single system Partial None None
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
199 CVE-2017-18410 20 2019-08-02 2019-08-12
4.0
 None Remote Low Single system Partial None None
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
200 CVE-2017-18409 20 2019-08-02 2019-08-12
4.0
 None Remote Low Single system Partial None None
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
Total number of vulnerabilities : 369   Page : 1 2 3 4 (This Page)5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.