8.8Alta
WebPros cPanel
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
Vulnerabilidades de WebPros (CVE)
Registros CVE publicados para WebPros, los más recientes primero. Siga el producto para recibir un correo con cada nueva.
cPanel 20Plesk 14WP Squared 14cPanel (CloudLinux 6, CentOS 6) 5ConfigServer Security & Firewall 3WHMCS 3Comet Backup 2plesk obsidian 1Plesk Site Import 1SolusVM 1SolusVM 2 1WHM 1Plesk extension "Node.js Toolkit" 1WordPress-Toolkit 1Plesk extension "Plesk RESTful API" 1Plesk extension "Ruby" 1WP Toolkit 1Plesk extension "Site Import" 1WP Toolkit for cPanel 1Plesk Migrator 1
8.7Alta
WebPros cPanel
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
9.4Crítica
WebPros SolusVM 2
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
8.5Alta
WebPros WP Toolkit
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
9.0Crítica
Webpros cPanel; Webpros WP Squared
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
9.0Crítica
Webpros cPanel; Webpros WP Squared
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
9.9Crítica
Webpros cPanel; Webpros WP Squared
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
9.4Crítica
WebPros WP Toolkit for cPanel
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
9.4Crítica
WebPros cPanel
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
9.4Crítica
WebPros Plesk extension "Site Import"
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
1.1%EPSS
8.7Alta
WebPros Plesk; WebPros Plesk extension "Plesk RESTful API"
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
8.2Alta
WebPros cPanel
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
9.4Crítica
Webpros SolusVM
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
8.7Alta
WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit"
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
9.3Crítica
WebPros WHMCS
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
9.9Crítica
WebPros Plesk
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
9.9Crítica
WebPros Plesk
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
9.5Crítica
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vuln…
1.4%EPSS
9.2Crítica
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software origina…
2.3%EPSS
9.9Crítica
WebPros cPanel
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
9.2Crítica
WebPros ConfigServer Security & Firewall; ConfigServer ConfigServer Security & Firewall
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary comman…
8.2Alta
WebPros WHMCS
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data …
8.5Alta
WebPros Plesk
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
9.0Crítica
WebPros Plesk
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allo…
1.3%EPSS
8.7Alta
WebPros cPanel
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.