cPanel TSR-2017-0003 Full Disclosure SEC-234 Summary Horde MySQL to SQLite conversion can leak database password. Security Rating cPanel has assigned this vulnerability a CVSSv3 score of 2.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N Description If the Horde MySQL to SQLite conversion script requires a password reset on the MySQL database, the new password was passed …
cPanel TSR-2017-0003 Full Disclosure Read More »
We are delaying the cPanel TSR-2017-0003 Disclosure for an additional 24 hours. The Disclosure will now be published May 17, 2017.
cPanel TSR-2017-0003 Disclosure Delay Read More »
cPanel TSR-2017-0003 Announcement cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system. cPanel has rated these updates as having CVSSv3 scores …
cPanel TSR-2017-0003 Announcement Read More »
In December 2016, the cPanel Security Team became aware of potential vulnerabilities in cPanel & WHM following an investigation of the hints provided in the Shadow Brokers / Equation Group leaks. During our investigation, we found several vulnerabilities in cgiecho and cgiemail, one of which could be leveraged for remote …
cPanel Security Team: Cgiemail (CVE-2017-5613) Read More »
cPanel TSR-2017-0002 Full Disclosure SEC-208 Summary Addon domain conversion did not require a package for resellers. Security Rating cPanel has assigned this vulnerability a CVSSv3 score of 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L Description Previously, when you converted an addon domain to a normal account, it was not required that a reseller specify a …
cPanel TSR-2017-0002 Full Disclosure Read More »
With the first TSR release of 2015 we began providing CVSSv2 scores in our full disclosure of resolved security issues in cPanel & WHM. The CVSSv2 scoring system is a free and open standard that attempts to rate the severity of security vulnerabilities (finalized in June 2007). In June 2015 …
Updates to TSR announcement and disclosure information Read More »
cPanel TSR-2017-0001 Full Disclosure SEC-196 Summary Fixed password used for Munin MySQL test account. Security Rating cPanel has assigned this vulnerability a CVSSv2 score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) Description The Munin monitoring tool includes a plugin to check the status of the MySQL service. This plugin used a dedicated test MySQL …
TSR-2017-0001 Full Disclosure Read More »
cPanel TSR-2017-0001 Announcement cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system. cPanel has rated these updates as having CVSSv2 scores …
cPanel TSR-2017-0001 Announcement Read More »
