Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Cpanel
(Cpanel)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 402 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2008-05-28 | CVE-2008-2478 | scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel. | Cpanel | N/A | ||
2004-10-18 | CVE-2004-1603 | cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. | Cpanel | 5.5 | ||
2008-05-12 | CVE-2008-2071 | Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors. | Cpanel | N/A | ||
2008-05-12 | CVE-2008-2070 | The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors. | Cpanel | N/A | ||
2021-01-26 | CVE-2021-26267 | cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | Cpanel | 7.5 | ||
2023-04-27 | CVE-2023-29489 | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | Cpanel | 6.1 | ||
2021-08-11 | CVE-2021-38587 | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | Cpanel | 7.5 | ||
2021-08-11 | CVE-2021-38590 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | Cpanel | 5.5 | ||
2020-11-27 | CVE-2020-29136 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). | Cpanel | 6.5 | ||
2021-08-11 | CVE-2021-38584 | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | Cpanel | 7.2 |