Cpanel : Security Vulnerabilities CVSS score between 5 and 5.99
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
| Max Base Score | 5.5 |
| Published | 2021-08-11 |
| Updated | 2022-05-03 |
| EPSS | 0.04% |
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).
| Max Base Score | 5.3 |
| Published | 2020-05-11 |
| Updated | 2021-07-21 |
| EPSS | 0.17% |
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
| Max Base Score | 5.3 |
| Published | 2020-03-17 |
| Updated | 2021-07-21 |
| EPSS | 0.07% |
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
| Max Base Score | 5.4 |
| Published | 2020-03-17 |
| Updated | 2020-03-19 |
| EPSS | 0.05% |
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
| Max Base Score | 5.5 |
| Published | 2020-03-17 |
| Updated | 2020-03-19 |
| EPSS | 0.04% |
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
| Max Base Score | 5.5 |
| Published | 2020-03-16 |
| Updated | 2020-08-24 |
| EPSS | 0.05% |
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
| Max Base Score | 5.3 |
| Published | 2019-07-30 |
| Updated | 2020-08-24 |
| EPSS | 0.08% |
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
| Max Base Score | 5.5 |
| Published | 2019-07-30 |
| Updated | 2021-07-21 |
| EPSS | 0.04% |
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
| Max Base Score | 5.5 |
| Published | 2019-07-30 |
| Updated | 2021-07-21 |
| EPSS | 0.04% |
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
| Max Base Score | 5.3 |
| Published | 2019-07-30 |
| Updated | 2020-08-24 |
| EPSS | 0.08% |
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
| Max Base Score | 5.5 |
| Published | 2019-07-30 |
| Updated | 2021-07-21 |
| EPSS | 0.04% |
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
| Max Base Score | 5.3 |
| Published | 2019-07-30 |
| Updated | 2020-08-24 |
| EPSS | 0.04% |
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
| Max Base Score | 5.4 |
| Published | 2019-07-30 |
| Updated | 2019-07-30 |
| EPSS | 0.05% |
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
| Max Base Score | 5.4 |
| Published | 2019-07-30 |
| Updated | 2019-07-30 |
| EPSS | 0.05% |
cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2019-08-08 |
| EPSS | 0.04% |
cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).
| Max Base Score | 5.6 |
| Published | 2019-08-01 |
| Updated | 2019-08-08 |
| EPSS | 0.04% |
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
| Max Base Score | 5.4 |
| Published | 2019-08-01 |
| Updated | 2019-08-07 |
| EPSS | 0.05% |
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).
| Max Base Score | 5.4 |
| Published | 2019-08-01 |
| Updated | 2019-08-07 |
| EPSS | 0.05% |
cPanel before 70.0.23 allows any user to disable Solr (SEC-371).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2019-08-01 |
| EPSS | 0.04% |
cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).
| Max Base Score | 5.4 |
| Published | 2019-08-01 |
| Updated | 2019-08-01 |
| EPSS | 0.05% |
cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).
| Max Base Score | 5.4 |
| Published | 2019-08-01 |
| Updated | 2019-08-01 |
| EPSS | 0.05% |
cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2020-08-24 |
| EPSS | 0.04% |
cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2020-08-24 |
| EPSS | 0.05% |
cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2019-08-02 |
| EPSS | 0.04% |
cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).
| Max Base Score | 5.5 |
| Published | 2019-08-01 |
| Updated | 2019-08-06 |
| EPSS | 0.04% |