CVE-2018-20891

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration SEC-436...

CVE-2018-20890

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits SEC-426...

CVE-2018-20887

CVE-2018-20887 affects cPanel prior to version 74.0.0, where a vulnerability in the database backup process allows SQL injection. The public description states the issue occurs during database backups and is labeled as SEC-420; multiple sources corroborate that the lack of input validation/execut...

CVE-2018-20885

CVE-2018-20885 affects cPanel prior to 74.0.0 and is caused by Apache HTTP Server configuration injection due to DocumentRoot variable interpolation (SEC-416). The available documents identify the affected product version and the vulnerability class but do not provide details on exploitation atte...

CVE-2018-20884

CVE-2018-20884 affects cPanel before 74.0.0; it describes a stored XSS in the WHM File Restoration interface (SEC-367). The connected sources corroborate the same description across multiple feeds (Red Hat, CNVD, NVD mirrors, CVE lists). No exploitation details or explicit remediation are provide...

CVE-2018-20882

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...

CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...

CVE-2018-20879

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API SEC-444...

CVE-2018-20878

CVE-2018-20878 affects cPanel prior to 74.0.8, where a stored XSS vulnerability exists in the WHM “File and Directory Restoration” interface (SEC-441). The CNVD entry notes the issue stems from a lack of proper validation of client-side data in the WEB application. Connected records consistently ...

CVE-2018-20876

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface SEC-434...

CVE-2018-20874

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface SEC-428...

CVE-2018-20885: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation SEC-416...

CVE-2018-20887: Improper Neutralization of Special Elements used in an SQL Command

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20916: Improper Neutralization of Input During Web Page Generation

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20884: Improper Neutralization of Input During Web Page Generation

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface SEC-367...

CVE-2016-10817: Improper Neutralization of Special Elements used in an SQL Command

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file SEC-123...

CVE-2016-10826: Improper Authentication

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

CVE-2016-10823: Improper Input Validation

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation SEC-89...

CVE-2016-10828: Improper Limitation of a Pathname to a Restricted Directory

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path SEC-97...

CVE-2018-20931: Improper Control of Generation of Code

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...