cPanel 76.0.17

CPE Details

cPanel 76.0.17
cpanel
cpanel
76.0.17
2019-07-31
15h43 +00:00
2019-07-31
15h43 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:cpanel:cpanel:76.0.17:*:*:*:*:*:*:*

Informations

Vendor

cpanel

Product

cpanel

Version

76.0.17

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-38584 2021-08-11 20h56 +00:00 The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
7.2
Haute
CVE-2021-38585 2021-08-11 20h55 +00:00 The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
7.2
Haute
CVE-2021-38587 2021-08-11 20h55 +00:00 In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
7.5
Haute
CVE-2021-38588 2021-08-11 20h55 +00:00 In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
8.1
Haute
CVE-2021-31803 2021-04-26 05h30 +00:00 cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
6.1
Moyen
CVE-2021-26266 2021-01-26 02h35 +00:00 cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
7.5
Haute
CVE-2021-26267 2021-01-26 02h35 +00:00 cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
7.5
Haute
CVE-2020-29137 2020-11-27 00h34 +00:00 cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
6.1
Moyen
CVE-2020-29135 2020-11-27 00h34 +00:00 cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
4.1
Moyen
CVE-2020-26098 2020-09-25 03h43 +00:00 cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
9.8
Critique
CVE-2020-26099 2020-09-25 03h43 +00:00 cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
7.5
Haute
CVE-2020-26100 2020-09-25 03h43 +00:00 chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
9.8
Critique
CVE-2020-26101 2020-09-25 03h43 +00:00 In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
9.8
Critique
CVE-2020-26102 2020-09-25 03h42 +00:00 In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
7.5
Haute
CVE-2020-26103 2020-09-25 03h42 +00:00 In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
7.5
Haute
CVE-2020-26104 2020-09-25 03h42 +00:00 In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
7.5
Haute
CVE-2020-26105 2020-09-25 03h42 +00:00 In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
9.8
Critique
CVE-2020-26106 2020-09-25 03h42 +00:00 cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
7.5
Haute
CVE-2020-26107 2020-09-25 03h42 +00:00 cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
7.5
Haute
CVE-2020-26108 2020-09-25 03h42 +00:00 cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
9.8
Critique
CVE-2020-26109 2020-09-25 03h41 +00:00 cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
7.5
Haute
CVE-2020-26110 2020-09-25 03h40 +00:00 cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
6.1
Moyen
CVE-2020-26111 2020-09-25 03h40 +00:00 cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
6.1
Moyen
CVE-2020-26112 2020-09-25 03h40 +00:00 The email quota cache in cPanel before 90.0.10 allows overwriting of files.
7.5
Haute
CVE-2020-26113 2020-09-25 03h40 +00:00 cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
6.1
Moyen
CVE-2020-26114 2020-09-25 03h40 +00:00 cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
6.1
Moyen
CVE-2020-26115 2020-09-25 03h40 +00:00 cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
6.1
Moyen
CVE-2020-10120 2020-03-17 13h39 +00:00 cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
7.2
Haute
CVE-2020-10119 2020-03-17 13h38 +00:00 cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
9.8
Critique
CVE-2019-17380 2019-10-09 13h11 +00:00 cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
6.1
Moyen
CVE-2019-14414 2019-07-30 12h20 +00:00 In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
3.3
Bas
CVE-2019-14413 2019-07-30 12h19 +00:00 cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
4.3
Moyen
CVE-2019-14412 2019-07-30 12h18 +00:00 Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
3.3
Bas
CVE-2019-14411 2019-07-30 12h18 +00:00 cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
5.3
Moyen
CVE-2019-14410 2019-07-30 12h17 +00:00 Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
3.3
Bas
CVE-2019-14409 2019-07-30 12h16 +00:00 cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
5.5
Moyen
CVE-2019-14408 2019-07-30 12h15 +00:00 cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
4.3
Moyen
CVE-2019-14407 2019-07-30 12h14 +00:00 cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
2.7
Bas
CVE-2019-14406 2019-07-30 12h13 +00:00 cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
6.1
Moyen
CVE-2019-14405 2019-07-30 12h12 +00:00 cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
8.8
Haute
CVE-2019-14404 2019-07-30 12h12 +00:00 cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
5.5
Moyen
CVE-2019-14403 2019-07-30 12h10 +00:00 cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
4.3
Moyen
CVE-2019-14402 2019-07-30 12h10 +00:00 cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
3.3
Bas
CVE-2019-14401 2019-07-30 12h08 +00:00 cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
8.8
Haute
CVE-2019-14400 2019-07-30 12h08 +00:00 cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
7.8
Haute
CVE-2019-14399 2019-07-30 12h07 +00:00 The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
7.1
Haute
CVE-2019-14398 2019-07-30 12h06 +00:00 cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
8.8
Haute
CVE-2019-14397 2019-07-30 12h05 +00:00 cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
5.3
Moyen
CVE-2019-14396 2019-07-30 12h04 +00:00 API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
3.3
Bas
CVE-2019-14395 2019-07-30 12h03 +00:00 cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
3.3
Bas
CVE-2019-14394 2019-07-30 12h03 +00:00 cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
5.5
Moyen
CVE-2019-14393 2019-07-30 12h02 +00:00 cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
5.3
Moyen
CVE-2019-14392 2019-07-30 12h00 +00:00 cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
8.8
Haute
CVE-2019-14391 2019-07-30 10h48 +00:00 cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
3.3
Bas
CVE-2019-14390 2019-07-30 10h47 +00:00 cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
5.4
Moyen
CVE-2019-14389 2019-07-30 10h46 +00:00 cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
7.8
Haute
CVE-2019-14388 2019-07-30 10h45 +00:00 cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
7.5
Haute
CVE-2019-14387 2019-07-30 10h43 +00:00 cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
6.1
Moyen
CVE-2019-14386 2019-07-30 10h38 +00:00 cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
5.4
Moyen
CVE-2008-6926 2009-08-10 18h00 +00:00 Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
6.8
CVE-2008-6927 2009-08-10 18h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
4.3
CVE-2009-2275 2009-07-01 10h26 +00:00 Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domain parameter.
5
CVE-2006-2825 2006-06-05 15h00 +00:00 cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow a local user to bypass open_basedir restrictions and access other virtual hosts via a PHP script that uses a main server URL (such as ~username) that is blocked by the user's own open_basedir directive, but not the main server's open_basedir directive.
5.1
CVE-2006-1119 2006-03-09 19h00 +00:00 fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.
4
CVE-2006-0763 2006-02-18 01h00 +00:00 Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter.
4.3
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.