CVE-2017-18454

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

CVE-2017-18452

CVE-2017-18452 affects cPanel before 64.0.21. The vulnerability allows code execution via Rails configuration files (SEC-259). Connected documents corroborate the issue across multiple sources (Red Hat, CNVD, NVD, CVE records). No additional exploit details, affected component versions beyond the...

CVE-2017-18450

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18450

CVE-2017-18450 affects cPanel prior to 64.0.21 and is associated with file-chmod operations via the script /scripts/convert_roundcube_mysql2sqlite (SEC-255). The vulnerability is documented across multiple sources (NVD, Red Hat, CVE lists) as allowing certain file permission changes and has CVSS ...

CVE-2017-18446

CVE-2017-18446 affects cPanel prior to 64.0.21. The issue allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). The Red Hat/CNVD/EUVD/ENISA entries corroborate the core description. Impact as stated is potential access to restricted files and modificati...

CVE-2017-18446

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...

CVE-2017-18445

CVE-2017-18445 affects cPanel prior to 64.0.21. The issue is that SSL API calls could bypass demo restrictions, as described in SEC-249. The available connected documents confirm the product/version and the nature of the vulnerability but do not provide exploits, in-the-wild details, or explicit ...

CVE-2017-18445

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls SEC-249...

CVE-2017-18442

CVE-2017-18442 : Affected software is cPanel prior to 64.0.21. The issue allows demo accounts to trigger Cpanel::SPFUI API commands (SEC-246), implying limited privilege elevation within the control panel API. The description and connected documents do not provide additional exploitation details ...

CVE-2017-18440

cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...

CVE-2017-18435

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API SEC-238...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2017-18425

In cPanel before 66.0.2, the cpdavderrorlog file can be created with weak permissions SEC-280...

CVE-2017-18424

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...

CVE-2017-18430

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft SEC-294...

CVE-2017-18417

cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...

Code injection

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...

Code injection

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...

Design/Logic Flaw

In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...

Cross site scripting

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...