Cpanel Security Vulnerabilities

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

CVE-2018-20867

cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).

CVE-2018-20870

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

CVE-2018-20873

cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).

CVE-2018-20874

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).

CVE-2018-20875

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

CVE-2018-20876

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

CVE-2018-20877

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

CVE-2018-20878

cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

CVE-2018-20879

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

CVE-2018-20880

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

CVE-2018-20882

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).

CVE-2018-20883

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).

CVE-2018-20886

cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

CVE-2018-20888

cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424).

CVE-2018-20889

cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

CVE-2018-20890

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

CVE-2018-20891

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

CVE-2018-20892

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

CVE-2018-20893

cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

CVE-2018-20894

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

CVE-2018-20895

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).

CVE-2018-20896

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

CVE-2018-20897

cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

CVE-2018-20898

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

CVE-2018-20899

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

CVE-2018-20900

cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

CVE-2018-20901

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

CVE-2018-20902

cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

CVE-2018-20903

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).

CVE-2018-20904

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

CVE-2018-20905

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).

CVE-2018-20906

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

CVE-2018-20907

cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

CVE-2018-20908

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

CVE-2018-20910

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).

CVE-2018-20911

cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).

CVE-2018-20912

cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).

CVE-2018-20913

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).

CVE-2018-20914

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).

CVE-2018-20915

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).

CVE-2018-20917

cPanel before 70.0.23 allows any user to disable Solr (SEC-371).