CVE-2018-20901

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...

CVE-2016-10857

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...

CVE-2018-20901

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...

CVE-2016-10858

cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning SEC-64...

CVE-2016-10858

cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning SEC-64...

CVE-2016-10855

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd SEC-91...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10851

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface SEC-84...

CVE-2016-10851

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface SEC-84...

CVE-2016-10852

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

CVE-2016-10850

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

CVE-2016-10850

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

CVE-2015-9291

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via getinformationforapplications CPANEL-1221...

Design/Logic Flaw

cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation SEC-408...

Design/Logic Flaw

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via getinformationforapplications CPANEL-1221...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action SEC-373...

Security feature bypass

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction SEC-427...

Design/Logic Flaw

cPanel before 71.9980.37 does not enforce the Mime::listhotlinks API feature restriction SEC-432...

Design/Logic Flaw

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

Information disclosure

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...