CVE-2018-20889

cPanel before 74.0.0 allows certain file-read operations via password file caching SEC-425...

CVE-2018-20889

CVE-2018-20889 affects cPanel prior to 74.0.0, where the password file caching mechanism allows certain file-read operations. The description indicates this is a vulnerability in how password file caching can be exploited to read files, but exploitation specifics, affected versions beyond the pre...

CVE-2018-20888

CVE-2018-20888 affects cPanel prior to 74.0.0, where an incorrect HTTP authentication context allows file modification by the root account. This is a local vulnerability with impact on integrity (as per the mounted CVSS data) and does not appear to have publicly documented exploitation details or...

CVE-2018-20888

cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication SEC-424...

CVE-2018-20887

CVE-2018-20887 affects cPanel prior to version 74.0.0, where a vulnerability in the database backup process allows SQL injection. The public description states the issue occurs during database backups and is labeled as SEC-420; multiple sources corroborate that the lack of input validation/execut...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20886

CVE-2018-20886 affects cPanel prior to version 74.0.0, where phpMyAdmin session files are stored insecurely. The entry cites a storage flaw that can impact confidentiality, integrity, and availability at a partial level (local access required; low attack complexity). Exploitation status and speci...

CVE-2018-20886

cPanel before 74.0.0 insecurely stores phpMyAdmin session files SEC-418...

CVE-2018-20885

CVE-2018-20885 affects cPanel prior to 74.0.0 and is caused by Apache HTTP Server configuration injection due to DocumentRoot variable interpolation (SEC-416). The available documents identify the affected product version and the vulnerability class but do not provide details on exploitation atte...

CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation SEC-416...

CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface SEC-367...

CVE-2018-20884

CVE-2018-20884 affects cPanel before 74.0.0; it describes a stored XSS in the WHM File Restoration interface (SEC-367). The connected sources corroborate the same description across multiple feeds (Red Hat, CNVD, NVD mirrors, CVE lists). No exploitation details or explicit remediation are provide...

CVE-2018-20883

CVE-2018-20883 affects cPanel prior to 74.0.8, where FTP access could be possible during an account suspension (SEC-449). The connected documents confirm the issue title and affected product/version, but do not provide additional technical details, exploit status, or remediation specifics beyond ...

CVE-2018-20883

cPanel before 74.0.8 allows FTP access during account suspension SEC-449...

CVE-2018-20882

CVE-2018-20882 affects cPanel prior to 74.0.8, enabling arbitrary file-write under the root context during WHM Force Password Change (SEC-447). This is a local-attack vector impacting systems running affected cPanel versions. The vulnerability arises in the root context during the password-change...

CVE-2018-20882

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...

CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...

CVE-2018-20881

CVE-2018-20881 affects cPanel prior to 74.0.8, enabling self‑stored XSS on the Security Questions login page (SEC-446). Relevant content from connected sources confirms this is a client‑side script execution vulnerability in the web interface, with no explicit exploitation details provided in the...

CVE-2018-20880

cPanel before 74.0.8 mishandles account suspension because of an invalid emailaccounts.json file SEC-445...

CVE-2018-20880

CVE-2018-20880 affects cPanel before 74.0.8. The root cause is mishandling of account suspension due to an invalid email_accounts.json file (SEC-445). According to the CVE metrics, exploitation is local, with a low-base-impact on availability and no confidentiality/integrity impact, and a low ove...