CVE-2019-14400

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing SEC-479...

CVE-2018-20937

cPanel before 68.0.27 does not validate database and dbuser names during renames SEC-321...

CVE-2019-14407

cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...

CVE-2019-14387

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

CVE-2019-14393

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution SEC-486...

CVE-2019-14409

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin SEC-466...

CVE-2018-20893

cPanel before 74.0.0 allows file-rename operations during account renames SEC-442...

CVE-2018-20951

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2019-20494

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers SEC-525...

CVE-2019-14395

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log SEC-494...

CVE-2019-14404

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtualuserspam router SEC-484...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains SEC-478...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...