8.4Hoch
WebPros Plesk
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
WebPros Schwachstellen (CVE)
Für WebPros veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.
cPanel 20Plesk 15WP Squared 14cPanel (CloudLinux 6, CentOS 6) 5WHMCS 3ConfigServer Security & Firewall 3Plesk extension "Site Import" 2Comet Backup 2SolusVM 2 1WHM 1Plesk extension "Node.js Toolkit" 1WordPress-Toolkit 1Plesk extension "Plesk RESTful API" 1Plesk extension "Ruby" 1WP Toolkit 1WP Toolkit for cPanel 1Plesk Migrator 1plesk obsidian 1Plesk Site Import 1SolusVM 1
9.2Kritisch
WebPros Plesk extension "Site Import"
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbit…
8.8Hoch
WebPros cPanel
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
8.7Hoch
WebPros cPanel
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
9.4Kritisch
WebPros SolusVM 2
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
8.5Hoch
WebPros WP Toolkit
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
9.0Kritisch
Webpros cPanel; Webpros WP Squared
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
9.0Kritisch
Webpros cPanel; Webpros WP Squared
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
9.9Kritisch
Webpros cPanel; Webpros WP Squared
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
9.4Kritisch
WebPros WP Toolkit for cPanel
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
9.4Kritisch
WebPros cPanel
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
9.4Kritisch
WebPros Plesk extension "Site Import"
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
1.1%EPSS
8.7Hoch
WebPros Plesk; WebPros Plesk extension "Plesk RESTful API"
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
8.2Hoch
WebPros cPanel
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
9.4Kritisch
Webpros SolusVM
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
8.7Hoch
WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit"
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
9.3Kritisch
WebPros WHMCS
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
9.9Kritisch
WebPros Plesk
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
9.9Kritisch
WebPros Plesk
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
9.5Kritisch
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vuln…
1.4%EPSS
9.2Kritisch
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software origina…
2.3%EPSS
9.9Kritisch
WebPros cPanel
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
9.2Kritisch
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary comman…
8.2Hoch
WebPros WHMCS
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data …
8.5Hoch
WebPros Plesk
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.