Remote code execution

cPanel before 68.0.15 allows local root code execution via cpdavd SEC-333...

Code injection

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...

Code injection

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...

Code injection

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

Design/Logic Flaw

cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases SEC-329...

CVE-2017-18416

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update SEC-303...

CVE-2017-18416

CVE-2017-18416 affects cPanel prior to 67.9999.103. The issue allows arbitrary file-overwrite during a Roundcube SQLite schema update (SEC-303). Connected sources confirm the vulnerability is tied to cPanel’s handling of the Roundcube SQLite schema update, enabling overwriting of arbitrary files....

CVE-2017-18414

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

CVE-2017-18413

In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears SEC-299...

CVE-2017-18411

The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...

CVE-2017-18410

CVE-2017-18410 affects cPanel before 67.9999.103, where a user account’s backup archive could contain all MySQL databases on the server, exposing sensitive data. The vulnerability is disclosed across multiple sources (NVD, Red Hat, CNVD, CVE lists). Root cause details are not provided beyond the ...

CVE-2017-18389

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...

CVE-2017-18386

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

Design/Logic Flaw

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

Design/Logic Flaw

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

Format string

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...

Sql injection

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload SEC-314...

CVE-2017-18405

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic SEC-345...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2017-18398

The CVE-2017-18398 entry refers to cPanel's DnsUtils prior to version 68.0.15, where zone creation is possible for hostname and account subdomains (SEC-331). This is documented across multiple connected sources (RH/CVE, NVD, CNVD/CNVD-2019-36129) indicating a vulnerability in the DNS management u...