CVE-2019-20494

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

CVE-2019-14395

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log SEC-494...

CVE-2019-14404

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtualuserspam router SEC-484...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains SEC-478...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2018-20925

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20895

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts SEC-393...

CVE-2018-20874

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface SEC-428...

CVE-2018-20875

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface SEC-433...

CVE-2018-20953

cPanel before 68.0.27 allows self XSS in the WHM listips interface SEC-389...

CVE-2018-20915

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-369...

CVE-2018-20907

cPanel before 71.9980.37 does not enforce the Mime::listhotlinks API feature restriction SEC-432...

CVE-2019-14388

cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled SEC-507...

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

CVE-2018-20942

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...