Recherche « Webpros cPanel »

WebPros WP Toolkit

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

WebPros cPanel

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

WebPros cPanel · Cpanel cpanel

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

WebPros cPanel · WebPros WP Squared

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

WebPros cPanel · WebPros WP Squared · Cpanel cpanel · Cpanel wp squared

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

WebPros cPanel · WebPros WP Squared · Cpanel cpanel · Cpanel wp squared

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

WebPros cPanel · WebPros cPanel (CloudLinux 6, CentOS 6) · WebPros WP Squared

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

WebPros cPanel · WebPros cPanel (CloudLinux 6, CentOS 6) · WebPros WP Squared

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.