Design/Logic Flaw

cPanel before 74.0.8 allows local users to disable the ClamAV daemon SEC-409...

CVE-2018-20891

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration SEC-436...

CVE-2018-20890

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits SEC-426...

CVE-2018-20887

CVE-2018-20887 affects cPanel prior to version 74.0.0, where a vulnerability in the database backup process allows SQL injection. The public description states the issue occurs during database backups and is labeled as SEC-420; multiple sources corroborate that the lack of input validation/execut...

CVE-2018-20885

CVE-2018-20885 affects cPanel prior to 74.0.0 and is caused by Apache HTTP Server configuration injection due to DocumentRoot variable interpolation (SEC-416). The available documents identify the affected product version and the vulnerability class but do not provide details on exploitation atte...

CVE-2018-20884

CVE-2018-20884 affects cPanel before 74.0.0; it describes a stored XSS in the WHM File Restoration interface (SEC-367). The connected sources corroborate the same description across multiple feeds (Red Hat, CNVD, NVD mirrors, CVE lists). No exploitation details or explicit remediation are provide...

CVE-2018-20882

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...

CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page SEC-446...

CVE-2018-20879

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API SEC-444...

CVE-2018-20878

CVE-2018-20878 affects cPanel prior to 74.0.8, where a stored XSS vulnerability exists in the WHM “File and Directory Restoration” interface (SEC-441). The CNVD entry notes the issue stems from a lack of proper validation of client-side data in the WEB application. Connected records consistently ...

CVE-2018-20876

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface SEC-434...

CVE-2018-20874

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface SEC-428...

CVE-2018-20876: Improper Neutralization of Input During Web Page Generation

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface SEC-434...

CVE-2016-10823: Improper Input Validation

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation SEC-89...

CVE-2016-10828: Improper Limitation of a Pathname to a Restricted Directory

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path SEC-97...

CVE-2016-10824: Improper Input Validation

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning SEC-90...

CVE-2018-20892: Undefined Security Weakness

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling SEC-439...

CVE-2018-20934: Improperly Implemented Security Check for Standard

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

CVE-2018-20921: Improper Neutralization of Input During Web Page Generation

cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action SEC-375...

CVE-2018-20942: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab SEC-351...