CVE-2018-20906: Incorrect Permission Assignment for Critical Resource

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

CVE-2018-20879: Improper Input Validation

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API SEC-444...

CVE-2018-20875: Improper Neutralization of Input During Web Page Generation

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface SEC-433...

CVE-2016-10837: Untrusted Search Path

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...

CVE-2016-10834: Improperly Implemented Security Check for Standard

cPanel before 55.9999.141 allows account-suspension bypass via ftp SEC-105...

CVE-2016-10840: Exposure of Resource to Wrong Sphere

cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication SEC-72...

CVE-2016-10847: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...

CVE-2016-10822: Improper Neutralization of Input During Web Page Generation

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

CVE-2016-10851: Improper Neutralization of Input During Web Page Generation

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface SEC-84...

CVE-2016-10854: Improper Neutralization of Input During Web Page Generation

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

CVE-2016-10853: Improper Neutralization of Input During Web Page Generation

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface SEC-86...

CVE-2016-10849: Improper Neutralization of Special Elements used in a Command

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit SEC-82...

CVE-2016-10817: Improper Neutralization of Special Elements used in an SQL Command

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file SEC-123...

CVE-2016-10818: Undefined Security Weakness

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...

CVE-2016-10815: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...

CVE-2018-20951: Improper Neutralization of Input During Web Page Generation

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

CVE-2016-10841: Undefined Security Weakness

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

CVE-2018-20880: Undefined Security Weakness

cPanel before 74.0.8 mishandles account suspension because of an invalid emailaccounts.json file SEC-445...

CVE-2018-20928: Improper Neutralization of Input During Web Page Generation

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface SEC-391...

CVE-2018-20885: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation SEC-416...