First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-10117

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://documentation.cpanel.net/display/CL/84+Change+LogVendor Advisory
https://documentation.cpanel.net/display/CL/84+Change+LogVendor Advisory

Timeline

Published: Mar 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101189.1cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).CVE-2020-101199.8cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).CVE-2020-10128.8<p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully ex CVE-2020-101207.2cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).CVE-2020-101219.8cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).CVE-2020-101226.5cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).CVE-2020-101235.3The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation req CVE-2020-101247.1NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host CVE-2020-101257.6NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software CVE-2020-101267.6NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacke CVE-2020-101285.4SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox p CVE-2020-101298.8SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.