CVE-2018-20953

CVE-2018-20953 affects cPanel before 68.0.27, enabling self-XSS in the WHM listips interface due to insufficient input validation. Impact is client-side code execution in the victim’s browser when interacting with the interface. The vulnerability is documented across multiple sources (NVD/Red Hat...

CVE-2018-20953

cPanel before 68.0.27 allows self XSS in the WHM listips interface SEC-389...

CVE-2018-20952

CVE-2018-20952 affects cPanel prior to 68.0.27. The issue involves world-readable files created during use of the WHM Apache Includes Editor (SEC-388). The public description confirms the vulnerable state; no exploitation details are provided in the supplied documents. Remediation appears to be u...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20951

CVE-2018-20951 affects cPanel prior to 68.0.27, enabling a self XSS in the WHM Spamd Startup Config. The vulnerability stems from insufficient validation of client-controlled data in the Startup Config, allowing execution of client-side code in some contexts. Affected software is cPanel/WHM (Spam...

CVE-2018-20951

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

CVE-2018-20950

cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer SEC-386...

CVE-2018-20949

Summary: CVE-2018-20949 affects cPanel prior to 68.0.27, specifically the WHM Apache Configuration Include Editor. The root cause is a lack of proper validation of client-side data, enabling a self XSS condition. Impact (as documented): self XSS could allow an attacker to execute client-side code...

CVE-2018-20949

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor SEC-385...

CVE-2018-20933

cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...

CVE-2018-20926

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

CVE-2018-20925

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

Design/Logic Flaw

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface SEC-379...

Design/Logic Flaw

cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface SEC-380...

Cross site scripting

cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action SEC-410...

Cross site scripting

cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action SEC-412...

CVE-2018-20938

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls SEC-324...

CVE-2018-20935

CVE-2018-20935 affects cPanel before 70.0.23, enabling stored XSS via the WHM action “Reset a DNS Zone” (SEC-412). Root cause cited as insufficient validation of client-side data. Impact is stored XSS; CVSS metrics in NVD show MEDIUM/LOW levels. A fix is available in or after version 70.0.23 (see...