U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:a:cpanel:cpanel:82.0.14:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 50 matching records.
Displaying matches 21 through 40.
Vuln ID Summary CVSS Severity
CVE-2020-26104

In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26103

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26102

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).

Published: September 25, 2020; 2:15:13 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26101

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

Published: September 25, 2020; 2:15:13 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 5.0 MEDIUM
CVE-2020-26100

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

Published: September 25, 2020; 2:15:13 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2020-26099

cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).

Published: September 25, 2020; 2:15:13 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26098

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

Published: September 25, 2020; 2:15:13 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2020-10120

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).

Published: March 17, 2020; 11:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.2 HIGH
V2.0: 9.0 HIGH
CVE-2020-10119

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2019-20498

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2019-20497

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2019-20496

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 5.5 MEDIUM
V2.0: 4.9 MEDIUM
CVE-2019-20495

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 6.5 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2019-20494

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).

Published: March 17, 2020; 11:15:13 AM -0400 		V4.0:(not available)
 V3.1: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

Published: March 17, 2020; 11:15:12 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2019-20492

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

Published: March 17, 2020; 11:15:12 AM -0400 		V4.0:(not available)
 V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM
CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

Published: March 17, 2020; 11:15:12 AM -0400 		V4.0:(not available)
 V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM
CVE-2019-20491

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).

Published: March 16, 2020; 5:15:12 PM -0400 		V4.0:(not available)
 V3.1: 5.4 MEDIUM
V2.0: 5.5 MEDIUM
CVE-2019-17380

cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).

Published: October 09, 2019; 12:15:15 PM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2019-17379

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).

Published: October 09, 2019; 12:15:15 PM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM