Authentication flaw

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magicrevision SEC-100...

Design/Logic Flaw

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf SEC-308...

Cross site scripting

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

Authentication flaw

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

Design/Logic Flaw

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

Design/Logic Flaw

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents SEC-92...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task SEC-352...

Code injection

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups SEC-342...

Design/Logic Flaw

cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin SEC-349...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...

Design/Logic Flaw

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor SEC-385...

Design/Logic Flaw

cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test SEC-353...

Design/Logic Flaw

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

Code injection

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls SEC-324...

Design/Logic Flaw

cPanel before 55.9999.141 allows account-suspension bypass via ftp SEC-105...

Sql injection

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation SEC-89...

Design/Logic Flaw

cPanel before 68.0.27 does not validate database and dbuser names during renames SEC-321...