CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Cpanel » Cpanel » 64.0.1 : Security Vulnerabilities

Cpe Name:cpe:/a:cpanel:cpanel:64.0.1
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2017-18419 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
102 CVE-2017-18418 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
103 CVE-2017-18417 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
104 CVE-2017-18416 284 2019-08-02 2019-08-12
3.6
None Local Low Not required None Partial Partial
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
105 CVE-2017-18415 20 Exec Code 2019-08-02 2019-08-12
4.6
None Local Low Not required Partial Partial Partial
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
106 CVE-2017-18414 601 2019-08-02 2019-08-12
5.8
None Remote Medium Not required Partial Partial None
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
107 CVE-2017-18413 264 2019-08-02 2019-08-12
4.6
None Local Low Not required Partial Partial Partial
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
108 CVE-2017-18412 532 2019-08-02 2019-08-12
1.9
None Local Medium Not required Partial None None
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
109 CVE-2017-18411 20 2019-08-02 2019-08-12
4.0
None Remote Low Single system Partial None None
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
110 CVE-2017-18410 20 2019-08-02 2019-08-12
4.0
None Remote Low Single system Partial None None
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
111 CVE-2017-18409 20 2019-08-02 2019-08-12
4.0
None Remote Low Single system Partial None None
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
112 CVE-2017-18408 79 XSS 2019-08-02 2019-08-12
3.5
None Remote Medium Single system None Partial None
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
113 CVE-2017-18407 347 2019-08-02 2019-08-12
5.8
None Remote Medium Not required Partial Partial None
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
114 CVE-2017-18406 89 Sql 2019-08-02 2019-08-12
5.0
None Remote Low Not required None Partial None
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
115 CVE-2017-18405 20 2019-08-02 2019-08-12
2.1
None Local Low Not required Partial None None
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
116 CVE-2017-18404 284 2019-08-02 2019-08-13
4.9
None Remote Medium Single system None Partial Partial
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
117 CVE-2017-18403 284 Exec Code 2019-08-02 2019-08-13
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
118 CVE-2017-18402 79 XSS 2019-08-02 2019-08-13
3.5
None Remote Medium Single system None Partial None
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
119 CVE-2017-18401 20 2019-08-02 2019-08-13
4.0
None Remote Low Single system None Partial None
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
120 CVE-2017-18400 77 Exec Code 2019-08-02 2019-08-13
7.2
None Local Low Not required Complete Complete Complete
cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
121 CVE-2017-18399 264 2019-08-02 2019-08-13
4.3
None Remote Medium Not required Partial None None
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
122 CVE-2017-18398 20 2019-08-02 2019-08-13
5.5
None Remote Low Single system Partial Partial None
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
123 CVE-2017-18397 275 2019-08-02 2019-08-13
2.1
None Local Low Not required Partial None None
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
124 CVE-2017-18396 200 +Info 2019-08-02 2019-08-13
4.9
None Local Low Not required Complete None None
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
125 CVE-2017-18395 20 2019-08-02 2019-08-13
4.0
None Remote Low Single system Partial None None
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
126 CVE-2017-18394 20 2019-08-02 2019-08-13
4.0
None Remote Low Single system Partial None None
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
127 CVE-2017-18393 20 2019-08-02 2019-08-13
4.0
None Remote Low Single system Partial None None
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
128 CVE-2017-18392 20 2019-08-02 2019-08-13
2.1
None Remote High Single system None Partial None
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).
129 CVE-2017-18391 200 +Info 2019-08-02 2019-08-09
1.9
None Local Medium Not required Partial None None
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
130 CVE-2017-18390 275 Exec Code 2019-08-02 2019-08-08
7.2
None Local Low Not required Complete Complete Complete
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
131 CVE-2017-18389 74 2019-08-02 2019-08-08
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
132 CVE-2017-18388 20 2019-08-02 2019-08-09
7.2
None Local Low Not required Complete Complete Complete
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
133 CVE-2017-18387 74 Exec Code 2019-08-02 2019-08-12
9.0
None Remote Low Single system Complete Complete Complete
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).
134 CVE-2017-18386 74 Exec Code 2019-08-02 2019-08-06
9.0
None Remote Low Single system Complete Complete Complete
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).
135 CVE-2017-18385 284 2019-08-02 2019-08-06
2.1
None Local Low Not required Partial None None
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
136 CVE-2017-18384 284 2019-08-02 2019-08-06
2.1
None Local Low Not required Partial None None
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
137 CVE-2017-18383 264 2019-08-02 2019-08-06
4.6
None Local Low Not required Partial Partial Partial
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
138 CVE-2017-18382 20 2019-08-02 2019-08-06
4.0
None Remote Low Single system Partial None None
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
Total number of vulnerabilities : 137   Page : 1 2 3 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.