cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
CVSS Score
5.3
EPSS Score
0.008
Published
2020-03-17
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
CVSS Score
9.1
EPSS Score
0.01
Published
2020-03-17
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
CVSS Score
9.1
EPSS Score
0.01
Published
2020-03-17
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
CVSS Score
9.8
EPSS Score
0.022
Published
2020-03-17
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
CVSS Score
8.8
EPSS Score
0.011
Published
2020-03-17
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
CVSS Score
8.8
EPSS Score
0.013
Published
2020-03-17
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
CVSS Score
6.1
EPSS Score
0.007
Published
2020-03-17
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
CVSS Score
5.4
EPSS Score
0.007
Published
2020-03-16
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-02-10
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
CVSS Score
8.8
EPSS Score
0.011
Published
2019-10-09