Code injection

In cPanel before 62.0.17, addon domain conversion did not require a package for resellers SEC-208...

Code injection

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

Design/Logic Flaw

cPanel before 64.0.21 allows demo accounts to execute SSH API commands SEC-248...

Design/Logic Flaw

cPanel before 64.0.21 does not preserve supplemental groups across account renames SEC-260...

Code injection

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...

Code injection

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

Code injection

cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...

Code injection

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...

Code injection

cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...

Design/Logic Flaw

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

Design/Logic Flaw

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename SEC-223...

Code injection

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls SEC-249...

Code injection

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding SEC-247...

Design/Logic Flaw

cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade SEC-257...

Design/Logic Flaw

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

Design/Logic Flaw

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...

Cross site scripting

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

Code injection

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call SEC-243...

Code injection

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...

Code injection

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...