CVE-2017-18480

CVE-2017-18480 affects cPanel/WHM: prior to 62.0.4, has_mycnf_for_cpuser API calls do not enforce account ownership, per SEC-210. Root cause is missing ownership checks in those WHM API calls. Impact as stated: potential exposure of sensitive configuration data via API calls; CVSS v3 vector indic...

CVE-2017-18479

CVE-2017-18479 affects cPanel prior to 62.0.4, where WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). The issue is documented with CVSS metrics (CVSSv2 base 4.0, MEDIUM; CVSSv3 base 6.5, MEDIUM). Affected component: WHM/cPanel SSL certificate generation process; root ca...

CVE-2017-18478

In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions SEC-207...

CVE-2017-18478

Affected software: cPanel prior to 62.0.4. Vulnerability: incorrect ACL checks in xml-api for Rearrange Account actions, caused by an ACL bypass issue. Impact: potential improper access control. Mitigation: upgrade to 62.0.4 or later (as cited by cPanel and related CVE records). Notes: the connec...

CVE-2017-18477

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account SEC-206...

CVE-2017-18476

CVE-2017-18476 concerns Leech Protect in cPanel prior to 62.0.4 not protecting certain directories (bug tracked as SEC-205). The connected sources consistently state this issue affecting cPanel. No further technical details (root cause, impacted components beyond Leech Protect, exploit vectors, o...

CVE-2017-18476

Leech Protect in cPanel before 62.0.4 does not protect certain directories SEC-205...

CVE-2017-18474

cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases SEC-201...

CVE-2017-18473

CVE-2017-18473 affects cPanel before 62.0.4, where the Webmail Password and Security page is vulnerable to a self-XSS due to insufficient input validation. Root cause cited in CNVD as lack of proper validation of client-side data. Impact is self-XSS on affected page; exploitation details are not ...

CVE-2017-18471

cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...

CVE-2017-18471

Summary: CVE-2017-18471 affects cPanel versions before 62.0.4. The issue is a self‑XSS vulnerability on the paper_lantern password‑change screen. Affected software/component: cPanel hosting control panel; paper_lantern password‑change UI. Root cause: Self‑XSS due to insufficient input/output hand...

CVE-2017-18469

CVE-2017-18469 affects cPanel prior to 62.0.17, where demo accounts can execute code via an NVData_fetchinc API call (SEC-233). Affected software: cPanel versions before 62.0.17. Root cause: exploitable API call allowing code execution. Impact: potential arbitrary code execution by unauthenticate...

CVE-2017-18467

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18464

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor SEC-226...

Design/Logic Flaw

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

Design/Logic Flaw

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18468

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...

CVE-2017-18468

CVE-2017-18468 affects cPanel prior to 62.0.17. The vulnerability arises in the Htaccess::setphppreference API (SEC-232), enabling code execution by demo accounts. No exploitation details are provided in the documents. Affected software: cPanel before 62.0.17. Impact: remote code execution by una...

CVE-2017-18467

CVE-2017-18467 affects cPanel prior to version 62.0.17. A URL filtering error (SEC-229) allows access to restricted resources. The core issue is a URL filtering flaw in the affected path, enabling unintended resource access. Remediation: upgrade to at least 62.0.17 (as indicated by the CVE descri...