Product:

Cpanel

(Cpanel)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 415
Date Id Summary Products Score Patch Annotated
2008-05-28 CVE-2008-2478 scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel. Cpanel N/A
2004-10-18 CVE-2004-1603 cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. Cpanel 5.5
2008-05-12 CVE-2008-2071 Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors. Cpanel N/A
2008-05-12 CVE-2008-2070 The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors. Cpanel N/A
2019-07-30 CVE-2019-14394 cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). Cpanel 5.5
2019-07-30 CVE-2019-14395 cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). Cpanel 3.3
2019-07-30 CVE-2019-14399 The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). Cpanel 7.1
2019-07-30 CVE-2019-14404 cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Cpanel 5.5
2019-07-30 CVE-2019-14407 cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). Cpanel 2.7
2019-07-30 CVE-2019-14409 cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). Cpanel 5.5