cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394)

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331)

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310)

cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382)

cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332)

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239)

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525)

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130)

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168)

cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219)

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291)

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289)

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274)

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273)

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272)

cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271)

cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330)

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355)

cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353)

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342)

cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339)

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308)

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443)

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445)

cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409)

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478)

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474)

Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472)

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481)

API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495)

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494)

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514)

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341)

cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395)

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228)

In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208)

cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288)

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334)

cPanel before 68.0.15 does not block a username of ssl (SEC-328)

cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327)

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326)

cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306)

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324)

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406)

cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415)

In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290)

In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280)

cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296)

cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323)

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352)