CVE-2018-20932

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20948

cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration SEC-383...

CVE-2018-20928

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface SEC-391...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20935

cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...

CVE-2018-20946

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...

CVE-2018-20949

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor SEC-385...

CVE-2017-18400

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

CVE-2019-14397

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

CVE-2019-14402

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20918

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster SEC-372...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

CVE-2017-18471

cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...

CVE-2018-20870

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...

CVE-2016-10782

cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10832

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging SEC-102...

CVE-2016-10860

cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API SEC-66...