cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473)

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496)

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486)

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245)

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226)

cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260)

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364)

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279)

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294)

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255)

In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589)

cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227)

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218)

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240)

cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425)

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133)

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229)

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223)

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249)

cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244)

cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321)

cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107)

cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432)

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430)

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427)

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396)

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439)

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426)

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476)

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460)

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483)

cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567)

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394)

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331)

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310)

cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382)

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332)

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239)

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525)

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130)

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168)

cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219)

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291)

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289)

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274)

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273)

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272)

cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271)

cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330)

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355)