CVE-2017-18435

This CVE affects cPanel before 64.0.21, where demo accounts could cause code execution via the BoxTrapper API (SEC-238). The issue is tied to the BoxTrapper API and is documented as exploitable by non-privileged, unauthenticated users, enabling remote code execution with low attacker effort. The ...

CVE-2017-18435

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...

CVE-2017-18434

CVE-2017-18434 affects cPanel prior to 64.0.21. The vulnerability allows code execution in the root account context via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). The provided connected Red Hat/CNVD/EUVD/PRION/CVE records corroborate the same core issue and describe the root caus...

CVE-2017-18434

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...

CVE-2017-18433

CVE-2017-18433 affects cPanel prior to version 64.0.21. The vulnerability allows code execution via the store_filter API call initiated by webmail and demo accounts (SEC-236). Multiple sources (Red Hat, CNVD, NVD, CVE registry) corroborate that the flaw exists in older cPanel builds; no public ex...

CVE-2017-18433

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...

CVE-2017-18432

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password SEC-234...

CVE-2017-18432

CVE-2017-18432 affects cPanel prior to 64.0.21, specifically the Horde MySQL to SQLite conversion process. The underlying issue is a leakage of a database password (SEC-234) during the conversion, enabling potential disclosure of database credentials. This vulnerability has a high impact on confi...

CVE-2017-18431

CVE-2017-18431 affects cPanel prior to 66.0.1 and relates to unreliable suspend/unsuspend operations on accounts (CPANEL-13941). Multiple sources (NVD entry and Red Hat advisory) document the issue with a CVSS v3 base score of 7.5 (HIGH) and an integrity impact described as HIGH, while attack vec...

CVE-2017-18431

cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts CPANEL-13941...

CVE-2017-18430

CVE-2017-18430 affects cPanel before 66.0.2, where user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). The issue’s CVSS indicates MEDIUM impact (Partial confidentiality, integrity, and availability) with LOCAL access required per CVSSv2, or NETWORK ...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2017-18429

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...

CVE-2017-18429

CVE-2017-18429 affects cPanel before 66.0.2. The issue is that Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Several connected sources corroborate the same description, without detailing root cause, exploited vectors, or remediation steps in the pr...

CVE-2017-18428

In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...

CVE-2017-18428

CVE-2017-18428 affects cPanel prior to 66.0.2. During log processing, Apache HTTP Server domlogs become temporarily world-readable, exposing potentially sensitive log information. This is caused by the log handling behavior described in SEC-290. The vulnerability is a local issue with information...

CVE-2017-18427

In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...

CVE-2017-18427

CVE-2017-18427 affects cPanel prior to 66.0.2, where weak log-file permissions can occur after account modification (SEC-289). The issue has been documented in Red Hat and NVD entries with a low severity (CVSS v3: 3.3; v2: 2.1) and a Partial confidentiality impact. Remediation is to apply the pat...

CVE-2017-18426

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...

CVE-2017-18426

CVE-2017-18426 affects cPanel prior to 66.0.2. The vulnerability allows resellers to read other accounts’ domain log files, an information-disclosure issue (SEC-288). The connected sources confirm the affected product and scope but do not provide exploit details or a patch/version for remediation...