Code injection

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...

Design/Logic Flaw

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

Open redirect

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

Privilege escalation

The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...

Design/Logic Flaw

cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...

Design/Logic Flaw

In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears SEC-299...

Design/Logic Flaw

cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...

Design/Logic Flaw

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer SEC-332...

Design/Logic Flaw

cPanel before 68.0.15 does not block a username of ssl SEC-328...

Code injection

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...

Code injection

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...

Input validation

In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases SEC-283...

Code injection

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

Code injection

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

Code injection

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...

Code injection

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

Code injection

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...

Cross site scripting

cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...

Sql injection

cPanel before 67.9999.103 allows SQL injection during eximstats processing SEC-276...

Design/Logic Flaw

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...