CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18397

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

CVE-2017-18396

The CVE-2017-18396 issue affects cPanel before 68.0.15, where Exim vdomainaliases enables arbitrary file-read operations. Root cause: improper handling in vdomainaliases leads to access to restricted files. Impact: potential disclosure of sensitive data on affected systems. Evidence from Red Hat ...

CVE-2017-18395

CVE-2017-18395 affects cPanel before 68.0.15, where the system does not block a username of ssl (SEC-328). This is corroborated by Red Hat and other records in the connected data. Public details describe the issue but do not provide a patch or remediation steps within the supplied documents. CVSS...

CVE-2017-18394

CVE-2017-18394 affects cPanel prior to 68.0.15, where the reserved usernames list is insufficient (SEC-327). The Red Hat entry repeats the same description. No further technical details (vulnerable component, exploit specifics, affected products beyond cPanel, or concrete remediation/patch versio...

CVE-2017-18392

CVE-2017-18392 affects cPanel prior to 68.0.15; the issue allows collisions because PostgreSQL databases can be assigned to multiple accounts (root cause described in multiple sources). Reported across NVD/Red Hat/CNVD databases with CVSS 3.0/2.0 scores (LOW). Concrete remediation steps are not p...

CVE-2017-18392

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...

CVE-2017-18391

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

CVE-2017-18389

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...

CVE-2017-18388

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...

CVE-2017-18386

CVE-2017-18386 affects cPanel prior to 68.0.15, where Maketext injection in PostgresAdmin allows arbitrary code execution. This is a high-severity issue (CVSS high), with an attacker able to trigger execution without user interaction. The documented fix is to upgrade to 68.0.15 or later. If explo...

CVE-2017-18386

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

CVE-2017-18385

CVE-2017-18385 affects cPanel before 68.0.15, where unprivileged users can access restricted directories during account restores (SEC-311). The issue is documented across multiple sources (cPanel changelog references and Red Hat/CNVD listings). Practical impact: restricted directory exposure duri...

CVE-2016-10820

cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...

CVE-2016-10814

cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...

Code injection

cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...

Design/Logic Flaw

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...

Cross site scripting

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...

CVE-2016-10814

cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...

CVE-2016-10814

cPanel before 57.9999.54 is vulnerable to a demo-mode escape via show_template.stor (SEC-119). Affected product: cPanel; issue arises in versions prior to 57.9999.54. The connected documents do not provide further exploit details. Remediation: upgrade to 57.9999.54 or later.