) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
- Keyword (text search): cpe:2.3:a:cpanel:cpanel:55.9999.148:*:*:*:*:*:*:*
- CPE Name Search: true
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2021-38588 |
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Published: August 11, 2021; 7:15:08 PM -0400 |
V4.0:(not available) V3.1: 8.1 HIGH V2.0: 6.8 MEDIUM |
| CVE-2021-38587 |
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Published: August 11, 2021; 7:15:08 PM -0400 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2021-38585 |
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). Published: August 11, 2021; 7:15:08 PM -0400 |
V4.0:(not available) V3.1: 7.2 HIGH V2.0: 6.5 MEDIUM |
| CVE-2021-38584 |
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Published: August 11, 2021; 7:15:08 PM -0400 |
V4.0:(not available) V3.1: 7.2 HIGH V2.0: 6.5 MEDIUM |
| CVE-2021-31803 |
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). Published: April 26, 2021; 4:15:07 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2021-26267 |
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). Published: January 26, 2021; 1:16:25 PM -0500 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2021-26266 |
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). Published: January 26, 2021; 1:16:25 PM -0500 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2020-29137 |
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). Published: November 26, 2020; 9:15:11 PM -0500 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-29135 |
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). Published: November 26, 2020; 9:15:10 PM -0500 |
V4.0:(not available) V3.1: 4.1 MEDIUM V2.0: 3.5 LOW |
| CVE-2020-26115 |
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-26114 |
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-26113 |
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-26112 |
The email quota cache in cPanel before 90.0.10 allows overwriting of files. Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2020-26111 |
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-26110 |
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2020-26109 |
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2020-26108 |
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 9.8 CRITICAL V2.0: 7.5 HIGH |
| CVE-2020-26107 |
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2020-26106 |
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 7.5 HIGH V2.0: 5.0 MEDIUM |
| CVE-2020-26105 |
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Published: September 25, 2020; 2:15:14 AM -0400 |
V4.0:(not available) V3.1: 9.8 CRITICAL V2.0: 5.0 MEDIUM |