CVE-2017-18440

cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...

CVE-2017-18435

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...

CVE-2017-18425

In cPanel before 66.0.2, the cpdavderrorlog file can be created with weak permissions SEC-280...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2017-18424

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2017-18417

cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...

Code injection

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...

Code injection

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...

Design/Logic Flaw

In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...

Cross site scripting

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...

Cross site scripting

cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing SEC-269...

CVE-2017-18436

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...

CVE-2017-18436

The CVE-2017-18436 issue affects cPanel prior to 64.0.21, where demo accounts can read files via the Fileman::getfileactions API2 call (SEC-239). Root cause: insufficient access control in the Fileman API allowing read access to files. Impact: potential partial disclosure of file contents for dem...

CVE-2017-18433

CVE-2017-18433 affects cPanel prior to version 64.0.21. The vulnerability allows code execution via the store_filter API call initiated by webmail and demo accounts (SEC-236). Multiple sources (Red Hat, CNVD, NVD, CVE registry) corroborate that the flaw exists in older cPanel builds; no public ex...

CVE-2017-18432

CVE-2017-18432 affects cPanel prior to 64.0.21, specifically the Horde MySQL to SQLite conversion process. The underlying issue is a leakage of a database password (SEC-234) during the conversion, enabling potential disclosure of database credentials. This vulnerability has a high impact on confi...

CVE-2017-18429

CVE-2017-18429 affects cPanel before 66.0.2. The issue is that Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Several connected sources corroborate the same description, without detailing root cause, exploited vectors, or remediation steps in the pr...

CVE-2017-18428

CVE-2017-18428 affects cPanel prior to 66.0.2. During log processing, Apache HTTP Server domlogs become temporarily world-readable, exposing potentially sensitive log information. This is caused by the log handling behavior described in SEC-290. The vulnerability is a local issue with information...

CVE-2017-18427

In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...

CVE-2017-18423

In this CVE, affected software is cPanel prior to 66.0.2. The issue causes domain log files to become readable after log processing (SEC-273). The provided documents do not specify the root cause details, affected components beyond the log handling, or a remediation/version fix. No exploitation d...