4118 matches found
CVE-2017-18397
cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
CVE-2017-18402
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...
CVE-2017-18395
cPanel before 68.0.15 does not block a username of ssl SEC-328...
CVE-2017-18396
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...
CVE-2017-18399
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
Design/Logic Flaw
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...
Remote code execution
cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...
Open redirect
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...
Design/Logic Flaw
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
Design/Logic Flaw
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears SEC-299...
Privilege escalation
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...
Code injection
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server SEC-284...
Code injection
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...
Design/Logic Flaw
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...
Design/Logic Flaw
cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...
Code injection
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...