Format string

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...

Code injection

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

Design/Logic Flaw

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

Code injection

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution SEC-486...

Code injection

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log SEC-494...

Design/Logic Flaw

cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...

Design/Logic Flaw

cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...

Design/Logic Flaw

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

Code injection

cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg SEC-487...

Code injection

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

Cross site scripting

cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing SEC-493...

Design/Logic Flaw

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...

Design/Logic Flaw

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

Design/Logic Flaw

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...

Design/Logic Flaw

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20870

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...

CVE-2018-20870

CVE-2018-20870 affects the WebDAV transport feature in cPanel versions before 76.0.8 . The vulnerability is that debug logging is enabled by this feature (SEC-467). The connected documents consistently echo this description but do not provide explicit exploit details, impacted products beyond the...

CVE-2018-20869

CVE-2018-20869 affects cPanel before 76.0.8, where arbitrary code execution is possible in the root context via dnssec adminbin (SEC-465). Multiple sources (NVD/Red Hat/CNVD/CVE lists) confirm the flaw allowing local escalation with high impact (C/H/I/A). Affected product is cPanel; vulnerable co...

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

CVE-2018-20862

The CVE-2018-20862 issue affects cPanel prior to 76.0.8, where PostgreSQL password changes are performed unsafely (SEC-366). Affected: cPanel’s password-change workflow for PostgreSQL. Impact: potential improper handling of password changes; CVSS indicates high impact (confidentiality, integrity,...