|
252221
|
4.4 |
MEDIUM
Local
|
cpanel
|
cpanel
|
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
|
CWE-284
Improper Access Control
|
CVE-2017-18457
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252222
|
6.1 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
|
CWE-79
Cross-site Scripting
|
CVE-2017-18456
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252223
|
2.7 |
LOW
Network
|
cpanel
|
cpanel
|
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2017-18455
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252224
|
5.4 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
|
CWE-79
Cross-site Scripting
|
CVE-2017-18454
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252225
|
4.9 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
|
CWE-20
Improper Input Validation
|
CVE-2017-18453
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252226
|
6.7 |
MEDIUM
Local
|
cpanel
|
cpanel
|
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
|
CWE-20
Improper Input Validation
|
CVE-2017-18452
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252227
|
5.3 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2017-18451
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252228
|
4.5 |
MEDIUM
Local
|
cpanel
|
cpanel
|
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2017-18450
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252229
|
5.5 |
MEDIUM
Local
|
cpanel
|
cpanel
|
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
|
CWE-20
Improper Input Validation
|
CVE-2017-18449
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
252230
|
5.3 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
|
CWE-22
Path Traversal
|
CVE-2017-18448
|
2024-11-21 12:20 |
2019-08-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|