CVE-2019-14394

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).

Source: CVE-2019-14394

CVE-2019-14402

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).

Source: CVE-2019-14402

CVE-2019-14403

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

Source: CVE-2019-14403

CVE-2019-14404

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).

Source: CVE-2019-14404

CVE-2019-14405

cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).

Source: CVE-2019-14405

CVE-2019-14407

cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

Source: CVE-2019-14407

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

Source: CVE-2018-20864

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).

Source: CVE-2018-20869

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).

Source: CVE-2018-20862

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

Source: CVE-2018-20866