CVE-2017-18392

CVE-2017-18392 affects cPanel prior to 68.0.15; the issue allows collisions because PostgreSQL databases can be assigned to multiple accounts (root cause described in multiple sources). Reported across NVD/Red Hat/CNVD databases with CVSS 3.0/2.0 scores (LOW). Concrete remediation steps are not p...

CVE-2017-18391

CVE-2017-18391 affects cPanel prior to 68.0.15, where backup files can be read during a short window because they are world-readable (SEC-323). The root cause is improper file permissions exposing backups locally. Affected product: cPanel/WHM (before 68.0.15). Impact: disclosure of backup data; s...

CVE-2017-18391

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

CVE-2017-18390

cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...

CVE-2017-18390

CVE-2017-18390 affects cPanel prior to 68.0.15. It enables code execution in the root context due to weak permissions on incremental backups (SEC-322). The vulnerability is documented as high-severity with local access requirements. Remediation: upgrade to 68.0.15 or later. Exploitation details a...

CVE-2017-18389

CVE-2017-18389 affects cPanel prior to 68.0.15. The issue is a string format injection in the dovecot-xaps-plugin, as described by SEC-318. The vulnerability stems from how the plugin handles format strings, enabling potential injection through malformed input. Exploitation details, impacted vers...

CVE-2017-18389

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...

CVE-2017-18388

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...

CVE-2017-18388

The CVE-2017-18388 entry concerns cPanel before 68.0.15 where unsafe file operations occur because Jailshell does not set the umask (SEC-315). Affected component: cPanel’s Jailshell. Root cause: missing umask handling in Jailshell leads to insecure file permissions during file operations. Impact ...

CVE-2017-18387

Affected software: cPanel prior to 68.0.15. The vulnerability is an arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). Root cause: Maketext injection allows code execution, enabling an attacker to run arbitrary code with high integrity/availability impact. Explo...

CVE-2017-18387

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...

CVE-2017-18386

CVE-2017-18386 affects cPanel prior to 68.0.15, where Maketext injection in PostgresAdmin allows arbitrary code execution. This is a high-severity issue (CVSS high), with an attacker able to trigger execution without user interaction. The documented fix is to upgrade to 68.0.15 or later. If explo...

CVE-2017-18386

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

CVE-2017-18385

CVE-2017-18385 affects cPanel before 68.0.15, where unprivileged users can access restricted directories during account restores (SEC-311). The issue is documented across multiple sources (cPanel changelog references and Red Hat/CNVD listings). Practical impact: restricted directory exposure duri...

CVE-2017-18385

cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores SEC-311...

CVE-2017-18384

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2017-18384

CVE-2017-18384 affects cPanel prior to version 68.0.15, where jailed accounts can restore files that lie outside of their jail confinement (SEC-310). The connected Red Hat and CVE records reiterate the same description without additional technical specifics on root cause or affected components be...

CVE-2017-18383

CVE-2017-18383 affects cPanel prior to 68.0.15, where home-directory backups are written to an incorrect location (SEC-309). Connected advisories confirm the issue and reference the change log and disclosure posts. The vulnerability involves a misplacement of backup files rather than executable c...

CVE-2017-18383

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

CVE-2017-18382

CVE-2017-18382 affects cPanel prior to 68.0.15, where DNS zone SOA records can contain an unreserved email address (SEC-306). Root cause: the vulnerability arises from how the SOA RDATA handles the email field. Impact: CVSS3 base score 2.7 (LOW); confidentiality impact LOW, no integrity/availabil...