CVE-2018-20896

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface SEC-394...

CVE-2018-20927

cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing SEC-382...

CVE-2018-20891

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration SEC-436...

CVE-2018-20919

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action SEC-373...

CVE-2018-20894

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...

CVE-2018-20867

cPanel before 76.0.8 has an open redirect when resetting connections SEC-462...

CVE-2018-20898

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation SEC-396...

CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface SEC-367...

CVE-2016-10836

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...

CVE-2016-10845

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/checksystemstorable SEC-78...

CVE-2016-10827

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

CVE-2016-10805

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...

CVE-2016-10809

In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process SEC-114...

CVE-2016-10818

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...

CVE-2016-10786

cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...

CVE-2016-10777

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

CVE-2016-10796

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files SEC-130...

CVE-2018-20908

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling SEC-435...

CVE-2018-20873

cPanel before 74.0.8 allows local users to disable the ClamAV daemon SEC-409...

CVE-2018-20913

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...