CVE-2017-18421

cPanel prior to 66.0.2 contains a vulnerability (SEC-271) that allows demo accounts to create databases and users. Affected: cPanel before 66.0.2. Root cause specifics are not detailed in the provided documents. Impact stated as unauthorized creation/management of databases and users. Remediation...

CVE-2017-18392

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

Design/Logic Flaw

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18384

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2017-18384

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

Design/Logic Flaw

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18401

CVE-2017-18401 affects cPanel prior to 68.0.15, where account creation could partially succeed with invalid username formats (SEC-334). The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD). A patch to 68.0.15 or later is the stated remediation in available references; no exp...

CVE-2017-18384

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2016-10816

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...

Design/Logic Flaw

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...

CVE-2016-10815

CVE-2016-10815 affects cPanel prior to 57.9999.54, enabling arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). The vulnerability stems from insufficient access controls in the Branding APIs, allowing an attacker to read files on behalf of Webmail users. No exploitati...

CVE-2018-20934

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

Code injection

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

Code injection

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20934

CVE-2018-20934 affects cPanel prior to 70.0.23, where the product fails to prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). The connected documents reiterate this description; no additional details (root cause, exact impact, affected versions beyond the pre-70....

CVE-2018-20931

The CVE-2018-20931 issue affects cPanel prior to 70.0.23, where demo (non-privileged) accounts can execute code via the Landing Page (SEC-405). The vulnerability enables code execution through the web interface and is reflected in multiple sources (e.g., NVD, RH, CNVD). Affected product: cPanel W...