U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:cpanel:cpanel:11.38.1.2:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 117 matching records.
Displaying matches 61 through 80.
Vuln ID Summary CVSS Severity
CVE-2015-9291

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).

Published: August 01, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

Published: August 01, 2019; 10:15:11 AM -0400 		V4.0:(not available)
 V3.0: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM
CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20883

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.5 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20880

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2018-20879

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 6.3 MEDIUM
V2.0: 6.5 MEDIUM
CVE-2018-20878

cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20877

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20876

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20875

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2019-14412

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM
CVE-2019-14410

Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-14409

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.5 MEDIUM
V2.0: 2.1 LOW
CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

Published: July 30, 2019; 11:15:11 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2019-14407

cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

Published: July 30, 2019; 11:15:11 AM -0400 		V4.0:(not available)
 V3.0: 2.7 LOW
V2.0: 4.0 MEDIUM