CVE-2018-20939

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2018-20943

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task SEC-352...

CVE-2018-20947

cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script SEC-356...

CVE-2016-10828

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path SEC-97...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10833

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...

Cross site scripting

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

CVE-2018-20934

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20926

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

CVE-2016-10848

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck SEC-81...

CVE-2016-10849

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...

CVE-2018-20930

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...

CVE-2016-10839

cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...

CVE-2016-10842

cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...

CVE-2018-20939

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20923

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

CVE-2018-20920

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-374...