CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

Code injection

API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...

Code injection

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetchsslcertificatesforfqdns API SEC-489...

Design/Logic Flaw

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing SEC-483...

Design/Logic Flaw

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing SEC-479...

Design/Logic Flaw

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

Design/Logic Flaw

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtualuserspam router SEC-484...

Design/Logic Flaw

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...

Code injection

cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...

Format string

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...