Cpanel
cpanel
426 CVEs • 6 products
Products (6)
Click to collapseToggle
Products (6)
Click to collapse
CVEs (426)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). |
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). |
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). |
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). |
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). |
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). |
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). |
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). |
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). |
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). |
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). |
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). |
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). |
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). |
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). |
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). |