Product:

Cpanel

(Cpanel)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 415
Date Id Summary Products Score Patch Annotated
2021-08-11 CVE-2021-38588 In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Cpanel 8.1
2021-08-11 CVE-2021-38589 In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). Cpanel 8.1
2021-08-11 CVE-2021-38590 In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Cpanel 5.5
2023-04-27 CVE-2023-29489 An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. Cpanel 6.1
2008-05-28 CVE-2008-2478 scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel. Cpanel N/A
2004-10-18 CVE-2004-1603 cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. Cpanel 5.5
2008-05-12 CVE-2008-2071 Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors. Cpanel N/A
2008-05-12 CVE-2008-2070 The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors. Cpanel N/A
2019-07-30 CVE-2019-14394 cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). Cpanel 5.5
2019-07-30 CVE-2019-14395 cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). Cpanel 3.3