CVE-2019-14403

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing SEC-483...

CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

Design/Logic Flaw

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing SEC-483...

Design/Logic Flaw

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

Code injection

API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...

Design/Logic Flaw

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing SEC-479...