CVE-2017-18392

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts SEC-325...

CVE-2017-18392

CVE-2017-18392 affects cPanel prior to 68.0.15; the issue allows collisions because PostgreSQL databases can be assigned to multiple accounts (root cause described in multiple sources). Reported across NVD/Red Hat/CNVD databases with CVSS 3.0/2.0 scores (LOW). Concrete remediation steps are not p...

CVE-2017-18391

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

CVE-2017-18389

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin SEC-318...

CVE-2017-18388

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask SEC-315...

CVE-2017-18386

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin SEC-313...

CVE-2017-18386

CVE-2017-18386 affects cPanel prior to 68.0.15, where Maketext injection in PostgresAdmin allows arbitrary code execution. This is a high-severity issue (CVSS high), with an attacker able to trigger execution without user interaction. The documented fix is to upgrade to 68.0.15 or later. If explo...

CVE-2017-18385

CVE-2017-18385 affects cPanel before 68.0.15, where unprivileged users can access restricted directories during account restores (SEC-311). The issue is documented across multiple sources (cPanel changelog references and Red Hat/CNVD listings). Practical impact: restricted directory exposure duri...

CVE-2017-18448: Improper Limitation of a Pathname to a Restricted Directory

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...

CVE-2017-18447: Improper Input Validation

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API SEC-251...

CVE-2017-18442: Improper Neutralization of Special Elements used in a Command

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...

CVE-2017-18441: URL Redirection to Untrusted Site

cPanel before 64.0.21 allows demo accounts to redirect web traffic SEC-245...

CVE-2017-18420: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing SEC-269...

CVE-2017-18452: Improper Input Validation

cPanel before 64.0.21 allows code execution via Rails configuration files SEC-259...

CVE-2017-18419: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation SEC-266...

CVE-2017-18438: Improper Restriction of XML External Entity Reference

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...

CVE-2017-18437: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders SEC-240...

CVE-2017-18415: Improper Input Validation

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...

CVE-2017-18422: Undefined Security Weakness

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...

CVE-2017-18417: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...