CVE-2016-10767

cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface SEC-159...

CVE-2017-18482

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...

CVE-2017-18482

CVE-2017-18482 affects cPanel before 62.0.4; the issue arises from resellers using the WHM enqueue_transfer_item API to queue non-rearrange modules (SEC-213). Root cause: exposed API misuse in WHM allowing unauthorized queueing actions. Impact: potential partial availability impact per CVSS v3 sc...

CVE-2017-18481

CVE-2017-18481 affects cPanel (specifically the WHM Account Suspension List interface) prior to version 62.0.4. The issue is a stored XSS vulnerability caused by insufficient input validation in the web interface, allowing attacker-supplied script to be stored and potentially executed in victims’...

CVE-2017-18481

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...

CVE-2017-18480

CVE-2017-18480 affects cPanel/WHM: prior to 62.0.4, has_mycnf_for_cpuser API calls do not enforce account ownership, per SEC-210. Root cause is missing ownership checks in those WHM API calls. Impact as stated: potential exposure of sensitive configuration data via API calls; CVSS v3 vector indic...

CVE-2017-18480

cPanel before 62.0.4 does not enforce account ownership for hasmycnfforcpuser WHM API calls SEC-210...

CVE-2017-18479

CVE-2017-18479 affects cPanel prior to 62.0.4, where WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). The issue is documented with CVSS metrics (CVSSv2 base 4.0, MEDIUM; CVSSv3 base 6.5, MEDIUM). Affected component: WHM/cPanel SSL certificate generation process; root ca...

CVE-2017-18479

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address SEC-209...

CVE-2017-18478

In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions SEC-207...

CVE-2017-18478

Affected software: cPanel prior to 62.0.4. Vulnerability: incorrect ACL checks in xml-api for Rearrange Account actions, caused by an ACL bypass issue. Impact: potential improper access control. Mitigation: upgrade to 62.0.4 or later (as cited by cPanel and related CVE records). Notes: the connec...

CVE-2017-18477

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account SEC-206...

CVE-2017-18477

CVE-2017-18477 : Affects cPanel before 62.0.4 where Exim transports could execute in the context of the nobody account (SEC-206). Root cause described as a context execution issue within Exim transports. Impact: potential privilege context exposure/run as nobody; document does not quantify additi...

CVE-2017-18476

CVE-2017-18476 concerns Leech Protect in cPanel prior to 62.0.4 not protecting certain directories (bug tracked as SEC-205). The connected sources consistently state this issue affecting cPanel. No further technical details (root cause, impacted components beyond Leech Protect, exploit vectors, o...

CVE-2017-18476

Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...

CVE-2017-18475

CVE-2017-18475 affects cPanel before 62.0.4. Exim piped filters run in the context of an incorrect user account when delivering to a system user (SEC-204). CVSS v3.0 base score 8.8 (HIGH) indicates potentially high impact on confidentiality, integrity and availability. Upgrade to cPanel 62.0.4 or...

CVE-2017-18475

In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user SEC-204...

CVE-2017-18474

cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases SEC-201...

CVE-2017-18474

CVE-2017-18474 affects cPanel before 62.0.4. The issue allows arbitrary file-read operations via Exim valiases, due to an improper handling path/resource filtering. Public descriptions consistently show impact as reading restricted files. Connected documents confirm the product/version and the un...

CVE-2017-18473

CVE-2017-18473 affects cPanel before 62.0.4, where the Webmail Password and Security page is vulnerable to a self-XSS due to insufficient input validation. Root cause cited in CNVD as lack of proper validation of client-side data. Impact is self-XSS on affected page; exploitation details are not ...