Design/Logic Flaw

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18463

cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...

CVE-2017-18463

CVE-2017-18463 affects cPanel versions prior to 62.0.17. An attacker can achieve code execution in the root account context through manipulation of a long DocumentRoot path (SEC-225). The available connected sources confirm the vulnerability description across Red Hat, CNVD/PRION listings and CVE...

CVE-2017-18461

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename SEC-223...

CVE-2017-18461

CVE‑2017‑18461 affects cPanel prior to 62.0.17, where security policy questions are not preserved across an account rename (SEC‑223). The NVD entry lists CVSS‑v3 base 4.3 (NETWORK, HIGH? actually LOW; see vector) and CVSS‑v2 base 5.0, with impact: integrity Low, otherwise None; exploitability low...

CVE-2017-18460

CVE-2017-18460 affects cPanel before 62.0.17, where the automatic SSL installation process allows arbitrary code execution (SEC-221). Affected: cPanel (pre-62.0.17). Root cause: vulnerability in SSL installation flow enabling code execution. Impact: arbitrary code execution with HIGH severity (pe...

CVE-2017-18460

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

CVE-2017-18459

CVE-2017-18459 affects cPanel prior to 62.0.17, where an arbitrary code execution flaw can occur during account modification (SEC-220). Multiple connected sources corroborate that the issue resides in cPanel’s account-modification workflow and allows code execution with local access, high impact,...

CVE-2017-18459

cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...

CVE-2017-18458

CVE-2017-18458 affects cPanel prior to 62.0.17. The issue allows a file to be overwritten when renaming an account (SEC-219). Primary information comes from cPanel advisories and vendor records; no exploit details are provided in the documents. The available sources confirm the affected product/v...

CVE-2017-18458

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

CVE-2017-18457

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...

CVE-2017-18457

CVE-2017-18457 affects cPanel prior to 62.0.17. The issue permits arbitrary file-read using WHM /styled/ URLs (SEC-218), due to a path handling flaw. Red Hat and other sources confirm the same vulnerability description. Affected product: cPanel/WHM. Impact: potential exposure of sensitive server ...

CVE-2017-18456

CVE-2017-18456 affects cPanel before 62.0.17, where the WHM cPAddons showsecurity interface is vulnerable to self-XSS due to improper input handling. Root cause details across connected sources indicate lack of proper validation of client data in the web UI, enabling a malicious actor to execute ...

CVE-2017-18456

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

CVE-2017-18455

In cPanel before 62.0.17, addon domain conversion did not require a package for resellers SEC-208...

CVE-2017-18455

CVE-2017-18455 affects cPanel prior to 62.0.17, where addon domain conversion did not require a package for resellers (SEC-208). The available connected documents confirm the same description across Red Hat, CVE lists, and other feeds, but do not provide explicit exploitation details or a cited r...

CVE-2017-18454

CVE-2017-18454 affects cPanel prior to 62.0.24, where stored XSS is possible in the WHM cPAddons install interface (SEC-262) due to insufficient input validation. Impact is client-side code execution in authenticated context; CVSS–low/medium ranges reflect partial confidentiality/integrity but no...

CVE-2017-18454

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

CVE-2017-18453

CVE-2017-18453 affects cPanel prior to 64.0.21. The issue is that supplemental groups are not preserved across account renames, as described in the SEC-260 entry. The connected sources consistently identify this as a behavior/version issue rather than a component-level defect with documented expl...