CVE-2017-18457

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...

CVE-2017-18448

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

CVE-2017-18475

In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user SEC-204...

CVE-2017-18394

cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...

CVE-2017-18451

cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade SEC-257...

CVE-2017-18439

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call SEC-243...

CVE-2017-18415

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...

CVE-2017-18442

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...

CVE-2017-18433

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...

CVE-2017-18406

cPanel before 67.9999.103 allows SQL injection during eximstats processing SEC-276...

CVE-2017-18460

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

CVE-2017-18424

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...

CVE-2017-18468

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...

CVE-2017-18387

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...

CVE-2017-18477

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account SEC-206...

CVE-2017-18396

cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...

CVE-2017-18459

cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...

CVE-2017-18411

The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2017-18420

cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing SEC-269...