CVE-2017-18450: Undefined Security Weakness

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite SEC-255...

CVE-2017-18426: Insertion of Sensitive Information into Log File

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...

CVE-2017-18418: Improper Neutralization of Input During Web Page Generation

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...

CVE-2017-18459: Improper Input Validation

cPanel before 62.0.17 allows arbitrary code execution during account modification SEC-220...

CVE-2017-18460: Improper Input Validation

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation SEC-221...

CVE-2017-18454: Improper Neutralization of Input During Web Page Generation

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface SEC-262...

CVE-2017-18445: Undefined Security Weakness

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls SEC-249...

CVE-2017-18414: URL Redirection to Untrusted Site

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html SEC-300...

CVE-2017-18391: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval SEC-323...

CVE-2017-18384: Improper Access Control

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail SEC-310...

CVE-2017-18425: Undefined Security Weakness

In cPanel before 66.0.2, the cpdavderrorlog file can be created with weak permissions SEC-280...

CVE-2016-10820

cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...

CVE-2016-10814

cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...

Code injection

cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...

Design/Logic Flaw

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...

Cross site scripting

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...

CVE-2016-10814

cPanel before 57.9999.54 allows demo-mode escape via showtemplate.stor SEC-119...

CVE-2016-10814

cPanel before 57.9999.54 is vulnerable to a demo-mode escape via show_template.stor (SEC-119). Affected product: cPanel; issue arises in versions prior to 57.9999.54. The connected documents do not provide further exploit details. Remediation: upgrade to 57.9999.54 or later.

CVE-2016-10817

CVE-2016-10817 affects cPanel prior to version 57.9999.54, where a SQL injection is possible via the ModSecurity TailWatch log file (SEC-123). Affected software is explicitly stated as cPanel; root cause is unvalidated SQL operations exposed through TailWatch. Impact is defined as high/critical i...

CVE-2016-10819

CVE-2016-10819 affects cPanel before 57.9999.54. When cpanellogd rotates user log files, they become world-readable, exposing user logs (classified as a confidentiality impact). The vulnerability is described consistently across multiple sources (NVD, Red Hat, CNVD, CVE listings). Remediation is ...