CVE-2017-18457

CVE-2017-18457 affects cPanel prior to 62.0.17. The issue permits arbitrary file-read using WHM /styled/ URLs (SEC-218), due to a path handling flaw. Red Hat and other sources confirm the same vulnerability description. Affected product: cPanel/WHM. Impact: potential exposure of sensitive server ...

CVE-2017-18456

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

CVE-2017-18456

CVE-2017-18456 affects cPanel before 62.0.17, where the WHM cPAddons showsecurity interface is vulnerable to self-XSS due to improper input handling. Root cause details across connected sources indicate lack of proper validation of client data in the web UI, enabling a malicious actor to execute ...

CVE-2017-18455

In cPanel before 62.0.17, addon domain conversion did not require a package for resellers SEC-208...

CVE-2017-18455

CVE-2017-18455 affects cPanel prior to 62.0.17, where addon domain conversion did not require a package for resellers (SEC-208). The available connected documents confirm the same description across Red Hat, CVE lists, and other feeds, but do not provide explicit exploitation details or a cited r...

CVE-2017-18454

CVE-2017-18454 affects cPanel prior to 62.0.24, where stored XSS is possible in the WHM cPAddons install interface (SEC-262) due to insufficient input validation. Impact is client-side code execution in authenticated context; CVSS–low/medium ranges reflect partial confidentiality/integrity but no...

CVE-2017-18454

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

CVE-2017-18453

CVE-2017-18453 affects cPanel prior to 64.0.21. The issue is that supplemental groups are not preserved across account renames, as described in the SEC-260 entry. The connected sources consistently identify this as a behavior/version issue rather than a component-level defect with documented expl...

CVE-2017-18453

cPanel before 64.0.21 does not preserve supplemental groups across account renames SEC-260...

CVE-2017-18452

cPanel before 64.0.21 allows code execution via Rails configuration files SEC-259...

CVE-2017-18452

CVE-2017-18452 affects cPanel before 64.0.21. The vulnerability allows code execution via Rails configuration files (SEC-259). Connected documents corroborate the issue across multiple sources (Red Hat, CNVD, NVD, CVE records). No additional exploit details, affected component versions beyond the...

CVE-2017-18451

CVE-2017-18451 affects cPanel prior to version 64.0.21 . The vulnerability allows an attacker to read a user’s crontab file for a short window during a cPAddon upgrade (SEC-257). This information disclosure is confirmed by multiple connected documents from cPanel/Red Hat/CNVD/CVE records. Impact ...

CVE-2017-18451

cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade SEC-257...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18450

CVE-2017-18450 affects cPanel prior to 64.0.21 and is associated with file-chmod operations via the script /scripts/convert_roundcube_mysql2sqlite (SEC-255). The vulnerability is documented across multiple sources (NVD, Red Hat, CVE lists) as allowing certain file permission changes and has CVSS ...

CVE-2017-18449

CVE-2017-18449 affects cPanel prior to 64.0.21. The issue enables certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). The vulnerability is caused by insufficient validation of file rename actions within the specified script path,...

CVE-2017-18449

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...

CVE-2017-18448

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

CVE-2017-18448

CVE-2017-18448 affects cPanel before 64.0.21, where a Serverinfo_manpage API call allows certain file-read operations (SEC-252). This can lead to partial confidentiality impact. Red Hat/CPE entries corroborate the issue; updating to 64.0.21 or newer is the documented remediation. If applying fixe...

CVE-2017-18447

CVE-2017-18447 affects cPanel before 64.0.21. The root cause is a vulnerability in the ClamScanner_getsocket API that enables code execution by demo accounts. Impact is code execution with low privileges; attack surface is the affected cPanel environment. The provided documents do not include exp...