Sql injection

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

Code injection

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...

CVE-2017-18405

CVE-2017-18405 affects cPanel before 68.0.15. The issue arises from the backup .htaccess modification logic (SEC-345) and enables arbitrary file-read operations. The vulnerability is locally exploitable with no user interaction required, and could lead to exposure of restricted files (confidentia...

CVE-2017-18405

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...

CVE-2017-18404

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...

CVE-2017-18404

CVE-2017-18404 affects cPanel prior to 68.0.15. The vulnerability allows deletion of domain data for domains with the .lock TLD. Root cause details are not fully specified in the provided documents, but multiple sources (NVD, Red Hat, CNVD, CVE listings) corroborate the issue. There is no explici...

CVE-2017-18403

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...

CVE-2017-18403

CVE-2017-18403 affects cPanel prior to 68.0.15. The vulnerability allows code execution in the context of the nobody account via Mailman archives (SEC-337). Impact details in the provided documents indicate a potential compromise of systems running affected cPanel versions. The recommended remedi...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2017-18402

CVE-2017-18402 affects cPanel versions before 68.0.15 and is a stored XSS vulnerability occurring during a cpaddons moderated upgrade (SEC-336). Multiple connected sources (RH, CNVD, NVD) confirm the flaw and its association with the upgrade path, without detailing exploit vectors. The applicable...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18401

CVE-2017-18401 affects cPanel prior to 68.0.15, where account creation could partially succeed with invalid username formats (SEC-334). The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD). A patch to 68.0.15 or later is the stated remediation in available references; no exp...

CVE-2017-18400

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

CVE-2017-18400

CVE-2017-18400 affects cPanel before 68.0.15, enabling local root code execution via the cpdavd component. The vulnerability is triggered by an attacker with local access, leading to complete control over the host’s root privileges as described in multiple sources (e.g., Red Hat advisory and CNVD...

CVE-2017-18399

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...

CVE-2017-18399

CVE-2017-18399 affects cPanel prior to 68.0.15. The issue allows an attacker to read the root user’s crontab file during a short interval when enabling or disabling the sqloptimizer feature (SEC-332). Public references in the dataset confirm affected product/version and the disclosure, with no ex...

CVE-2017-18398

The CVE-2017-18398 entry refers to cPanel's DnsUtils prior to version 68.0.15, where zone creation is possible for hostname and account subdomains (SEC-331). This is documented across multiple connected sources (RH/CVE, NVD, CNVD/CNVD-2019-36129) indicating a vulnerability in the DNS management u...

CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18397

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

CVE-2017-18397

CVE-2017-18397 affects cPanel prior to 68.0.15. The issue is that local backup transport does not preserve permissions, as described in SEC-330. The root cause is a permissions preservation defect in the local backup transport workflow. Impact is limited to affected backups with incorrect permiss...