CVE-2017-18396

cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...

CVE-2017-18397

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18394

cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2017-18399

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...

CVE-2017-18400

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

CVE-2017-18400

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18397

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

CVE-2017-18396

cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...

CVE-2017-18399

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

Remote code execution

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

Design/Logic Flaw

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

Code injection

In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server SEC-284...