CVE-2017-18469

CVE-2017-18469 affects cPanel prior to 62.0.17, where demo accounts can execute code via an NVData_fetchinc API call (SEC-233). Affected software: cPanel versions before 62.0.17. Root cause: exploitable API call allowing code execution. Impact: potential arbitrary code execution by unauthenticate...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18464

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...

CVE-2017-18466

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

CVE-2017-18467

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

CVE-2017-18468

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18465

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

CVE-2017-18467

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

CVE-2017-18468

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...

CVE-2017-18466

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

CVE-2017-18464

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...

CVE-2017-18465

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

Design/Logic Flaw

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

Design/Logic Flaw

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...

Design/Logic Flaw

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

Code injection

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...

Design/Logic Flaw

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

Code injection

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

CVE-2017-18468

CVE-2017-18468 affects cPanel prior to 62.0.17. The vulnerability arises in the Htaccess::setphppreference API (SEC-232), enabling code execution by demo accounts. No exploitation details are provided in the documents. Affected software: cPanel before 62.0.17. Impact: remote code execution by una...