Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

Design/Logic Flaw

cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication SEC-72...

Design/Logic Flaw

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled SEC-401...

Design/Logic Flaw

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath SEC-80...

Code injection

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

Design/Logic Flaw

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck SEC-81...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface SEC-391...

CVE-2018-20946

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archivesynczones script SEC-355...

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations SEC-354...

CVE-2018-20945

The CVE-2018-20945 issue affects cPanel prior to 68.0.27 (bin/csvprocess) and enables insecure file operations due to SEC-354. Affected product: cPanel / web hosting control panel. Root cause details are consistently described across connected records as insecure file handling in bin/csvprocess b...

CVE-2016-10832

CVE-2016-10832 affects cPanel prior to 55.9999.141. The vulnerability is an FTP cPHulk bypass via account name munging (SEC-102), enabling bypass of FTP authentication checks. Root cause: improper handling during the cPHulk workflow allows bypass when munging the account name. Impact: potential u...

CVE-2018-20943

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task SEC-352...

CVE-2016-10833

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...

CVE-2016-10834

CVE-2016-10834 affects cPanel versions before 55.9999.141, where an account-suspension could be bypassed via FTP (SEC-105). Concrete details across sources confirm the vulnerability exists in cPanel and that remediation is to upgrade to 55.9999.141 or later. The Red Hat/NVD entries corroborate th...

CVE-2016-10836

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...

CVE-2018-20933

CVE-2018-20933 affects cPanel before 70.0.23, with a Stored XSS via the WHM Edit DNS Zone action (SEC-410). The available connected documents confirm the vulnerable component as the WHM DNS editing workflow and identify the vulnerability class as stored cross-site scripting. No additional exploit...

CVE-2016-10837

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...

CVE-2016-10838

CVE-2016-10838 affects cPanel prior to 11.54.0.4, where the bin/fmq script allows arbitrary file-read operations. Root cause is a vulnerability in the bin/fmq routine enabling access to files that should be restricted. The impact is confidentiality loss (C of CVSS) with no listed impact to integr...

CVE-2018-20928

cPanel before 70.0.23 is affected by a stored XSS via the cpaddons vendor interface (SEC-391). Several sources describe this as a cross-site scripting vulnerability with client-side code execution potential due to improper validation of input data. No remediation details are provided in the docum...