Code injection

cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...

Code injection

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...

Code injection

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

Design/Logic Flaw

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

Design/Logic Flaw

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs SEC-218...

Design/Logic Flaw

cPanel before 64.0.21 does not preserve supplemental groups across account renames SEC-260...

Design/Logic Flaw

cPanel before 64.0.21 allows demo accounts to execute SSH API commands SEC-248...

Code injection

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

Code injection

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...

Design/Logic Flaw

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18463

cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...

CVE-2017-18463

CVE-2017-18463 affects cPanel versions prior to 62.0.17. An attacker can achieve code execution in the root account context through manipulation of a long DocumentRoot path (SEC-225). The available connected sources confirm the vulnerability description across Red Hat, CNVD/PRION listings and CVE...

CVE-2017-18461

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename SEC-223...

CVE-2017-18461

CVE‑2017‑18461 affects cPanel prior to 62.0.17, where security policy questions are not preserved across an account rename (SEC‑223). The NVD entry lists CVSS‑v3 base 4.3 (NETWORK, HIGH? actually LOW; see vector) and CVSS‑v2 base 5.0, with impact: integrity Low, otherwise None; exploitability low...

CVE-2017-18460

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

CVE-2017-18460

CVE-2017-18460 affects cPanel before 62.0.17, where the automatic SSL installation process allows arbitrary code execution (SEC-221). Affected: cPanel (pre-62.0.17). Root cause: vulnerability in SSL installation flow enabling code execution. Impact: arbitrary code execution with HIGH severity (pe...

CVE-2017-18459

CVE-2017-18459 affects cPanel prior to 62.0.17, where an arbitrary code execution flaw can occur during account modification (SEC-220). Multiple connected sources corroborate that the issue resides in cPanel’s account-modification workflow and allows code execution with local access, high impact,...

CVE-2017-18459

cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...

CVE-2017-18458

cPanel before 62.0.17 allows file overwrite when renaming an account SEC-219...

CVE-2017-18458

CVE-2017-18458 affects cPanel prior to 62.0.17. The issue allows a file to be overwritten when renaming an account (SEC-219). Primary information comes from cPanel advisories and vendor records; no exploit details are provided in the documents. The available sources confirm the affected product/v...