CWE-20
13,782 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVEs (13,782)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). |
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). |
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). |
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). |
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). |
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). |
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). |
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). |
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). |
cPanel before 68.0.15 does not block a username of ssl (SEC-328). |
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). |
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). |
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). |
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). |
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). |
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). |
cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). |
cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). |
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74). |