CVE-2017-18388

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...

CVE-2017-18386

CVE-2017-18386 affects cPanel prior to 68.0.15, where Maketext injection in PostgresAdmin allows arbitrary code execution. This is a high-severity issue (CVSS high), with an attacker able to trigger execution without user interaction. The documented fix is to upgrade to 68.0.15 or later. If explo...

CVE-2017-18386

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

CVE-2017-18385

CVE-2017-18385 affects cPanel before 68.0.15, where unprivileged users can access restricted directories during account restores (SEC-311). The issue is documented across multiple sources (cPanel changelog references and Red Hat/CNVD listings). Practical impact: restricted directory exposure duri...

CVE-2017-18445: Undefined Security Weakness

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls SEC-249...

CVE-2017-18437: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2017-18454: Improper Neutralization of Input During Web Page Generation

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

CVE-2017-18426: Insertion of Sensitive Information into Log File

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...

CVE-2017-18452: Improper Input Validation

cPanel before 64.0.21 allows code execution via Rails configuration files SEC-259...

CVE-2017-18415: Improper Input Validation

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...

CVE-2017-18391: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

CVE-2017-18448: Improper Limitation of a Pathname to a Restricted Directory

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

CVE-2017-18442: Improper Neutralization of Special Elements used in a Command

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...

CVE-2017-18459: Improper Input Validation

cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...

CVE-2017-18441: URL Redirection to Untrusted Site

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18418: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...

CVE-2017-18417: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...

CVE-2017-18447: Improper Input Validation

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...

CVE-2017-18414: URL Redirection to Untrusted Site

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

CVE-2017-18384: Improper Access Control

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...