CVE-2017-18437

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2017-18419

cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation SEC-266...

CVE-2017-18443

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding SEC-247...

CVE-2017-18470

cPanel before 62.0.4 has a fixed password for the Munin MySQL test account SEC-196...

CVE-2017-18434

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...

CVE-2017-18452

cPanel before 64.0.21 allows code execution via Rails configuration files SEC-259...

CVE-2017-18416

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...

CVE-2017-18403

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...

CVE-2017-18421

cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...

CVE-2017-18412

cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18474

cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases SEC-201...

CVE-2017-18447

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...

CVE-2017-18405

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...

CVE-2017-18441

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18414

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

CVE-2017-18458

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

CVE-2017-18476

Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...