cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66)

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65)

cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138)

cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225)

cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221)

cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220)

cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237)

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234)

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302)

In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299)

cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333)

cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322)

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315)

cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309)

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479)

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465)

cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366)

cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510)

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586)

cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579)

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578)

The email quota cache in cPanel before 90.0.10 allows overwriting of files

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557)

cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561)

cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558)

In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552)

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551)

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550)

cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491)

cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923)

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192)

Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205)

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224)

cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941)

cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276)

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104)

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46)

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221)

cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507)

cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300)

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238)

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368)

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585)

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585)

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545)

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314)

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313)

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101)

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81)