CVE-2017-18438

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18456

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

CVE-2017-18474

cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases SEC-201...

CVE-2017-18429

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...

CVE-2017-18384

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2017-18465

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

CVE-2017-18447

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...

CVE-2017-18423

In cPanel before 66.0.2, domain log files become readable after log processing SEC-273...

CVE-2017-18405

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...

CVE-2017-18441

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18414

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

CVE-2017-18432

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password SEC-234...

CVE-2017-18458

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

CVE-2017-18476

Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...

CVE-2017-18449

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...

CVE-2019-20498

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect SEC-534...

CVE-2019-20492

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file SEC-516...