CVE-2017-18xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

876 records · Page 5 of 9

• CVE-2017-18505: The twitter-plugin plugin before 2.55 for WordPress has XSS. Unscored

  The twitter-plugin plugin before 2.55 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18504: The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. Unscored

  The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

  Updated 2024-08-05
• CVE-2017-18503: The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. Unscored

  The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18502: The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. Unscored

  The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18501: The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. Unscored

  The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18500: The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. Unscored

  The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18499: The simple-membership plugin before 3.5.7 for WordPress has XSS. Unscored

  The simple-membership plugin before 3.5.7 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18498: The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. Unscored

  The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.

  Updated 2024-08-05
• CVE-2017-18497: The liveforms plugin before 3.4.0 for WordPress has XSS. Unscored

  The liveforms plugin before 3.4.0 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18496: The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. Unscored

  The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18495: The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. Unscored

  The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18494: The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. Unscored

  The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18493: The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. Unscored

  The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18492: The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. Unscored

  The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18491: The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. Unscored

  The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18490: The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. Unscored

  The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18489: The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. Unscored

  The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.

  Updated 2024-08-05
• CVE-2017-18488: The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. Unscored

  The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18487: The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. Unscored

  The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.

  Updated 2024-08-05
• CVE-2017-18486: Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided Unscored

  Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user

  Updated 2024-08-05
• CVE-2017-18485: Cognitoys Dino devices allow profiles_add.html CSRF. Unscored

  Cognitoys Dino devices allow profiles_add.html CSRF.

  Updated 2024-08-05
• CVE-2017-18484: Cognitoys Dino devices allow XSS via the SSID. Unscored

  Cognitoys Dino devices allow XSS via the SSID.

  Updated 2024-08-05
• CVE-2017-18483: ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID. Unscored

  ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.

  Updated 2024-08-05
• CVE-2017-18482: cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). Unscored

  cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).

  Updated 2024-08-05
• CVE-2017-18481: cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211). Unscored

  cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).

  Updated 2024-08-05
• CVE-2017-18480: cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210). Unscored

  cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).

  Updated 2024-08-05
• CVE-2017-18479: In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). Unscored

  In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).

  Updated 2024-08-05
• CVE-2017-18478: In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). Unscored

  In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).

  Updated 2024-08-05
• CVE-2017-18477: In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206). Unscored

  In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

  Updated 2024-08-05
• CVE-2017-18476: Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). Unscored

  Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).

  Updated 2024-08-05
• CVE-2017-18475: In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). Unscored

  In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).

  Updated 2024-08-05
• CVE-2017-18474: cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). Unscored

  cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).

  Updated 2024-08-05
• CVE-2017-18473: cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199). Unscored

  cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).

  Updated 2024-08-05
• CVE-2017-18472: cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). Unscored

  cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).

  Updated 2024-08-05
• CVE-2017-18471: cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197). Unscored

  cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).

  Updated 2024-08-05
• CVE-2017-18470: cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). Unscored

  cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).

  Updated 2024-08-05
• CVE-2017-18469: cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). Unscored

  cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

  Updated 2024-08-05
• CVE-2017-18468: cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). Unscored

  cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).

  Updated 2024-08-05
• CVE-2017-18467: cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229). Unscored

  cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).

  Updated 2024-08-05
• CVE-2017-18466: cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). Unscored

  cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).

  Updated 2024-08-05
• CVE-2017-18465: cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). Unscored

  cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).

  Updated 2024-08-05
• CVE-2017-18464: cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). Unscored

  cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).

  Updated 2024-08-05
• CVE-2017-18463: cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). Unscored

  cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).

  Updated 2024-08-05
• CVE-2017-18462: cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224). Unscored

  cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).

  Updated 2024-08-05
• CVE-2017-18461: cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). Unscored

  cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

  Updated 2024-08-05
• CVE-2017-18460: cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). Unscored

  cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).

  Updated 2024-08-05
• CVE-2017-18459: cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). Unscored

  cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).

  Updated 2024-08-05
• CVE-2017-18458: cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). Unscored

  cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

  Updated 2024-08-05
• CVE-2017-18457: cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). Unscored

  cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

  Updated 2024-08-05
• CVE-2017-18456: cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). Unscored

  cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).

  Updated 2024-08-05
• CVE-2017-18455: In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). Unscored

  In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).

  Updated 2024-08-05
• CVE-2017-18454: cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). Unscored

  cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).

  Updated 2024-08-05
• CVE-2017-18453: cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). Unscored

  cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

  Updated 2024-08-05
• CVE-2017-18452: cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). Unscored

  cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).

  Updated 2024-08-05
• CVE-2017-18451: cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). Unscored

  cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).

  Updated 2024-08-05
• CVE-2017-18450: cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). Unscored

  cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).

  Updated 2024-08-05
• CVE-2017-18449: cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). Unscored

  cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).

  Updated 2024-08-05
• CVE-2017-18448: cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). Unscored

  cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).

  Updated 2024-08-05
• CVE-2017-18447: cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). Unscored

  cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

  Updated 2024-08-05
• CVE-2017-18446: cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). Unscored

  cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

  Updated 2024-08-05
• CVE-2017-18445: cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). Unscored

  cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

  Updated 2024-08-05
• CVE-2017-18444: cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). Unscored

  cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

  Updated 2024-08-05
• CVE-2017-18443: cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). Unscored

  cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

  Updated 2024-08-05
• CVE-2017-18442: cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). Unscored

  cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).

  Updated 2024-08-05
• CVE-2017-18441: cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). Unscored

  cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

  Updated 2024-08-05
• CVE-2017-18440: cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). Unscored

  cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).

  Updated 2024-08-05
• CVE-2017-18439: cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). Unscored

  cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

  Updated 2024-08-05
• CVE-2017-18438: cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). Unscored

  cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

  Updated 2024-08-05
• CVE-2017-18437: cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). Unscored

  cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

  Updated 2024-08-05
• CVE-2017-18436: cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). Unscored

  cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).

  Updated 2024-08-05
• CVE-2017-18435: cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). Unscored

  cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

  Updated 2024-08-05
• CVE-2017-18434: cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). Unscored

  cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).

  Updated 2024-08-05
• CVE-2017-18433: cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). Unscored

  cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).

  Updated 2024-08-05
• CVE-2017-18432: In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). Unscored

  In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

  Updated 2024-08-05
• CVE-2017-18431: cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). Unscored

  cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).

  Updated 2024-08-05
• CVE-2017-18430: In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). Unscored

  In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).

  Updated 2024-08-05
• CVE-2017-18429: In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Unscored

  In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

  Updated 2024-08-05
• CVE-2017-18428: In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). Unscored

  In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).

  Updated 2024-08-05
• CVE-2017-18427: In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). Unscored

  In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

  Updated 2024-08-05
• CVE-2017-18426: cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). Unscored

  cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).

  Updated 2024-08-05
• CVE-2017-18425: In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280). Unscored

  In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).

  Updated 2024-08-05
• CVE-2017-18424: In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). Unscored

  In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).

  Updated 2024-08-05
• CVE-2017-18423: In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). Unscored

  In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

  Updated 2024-08-05
• CVE-2017-18422: In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). Unscored

  In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).

  Updated 2024-08-05
• CVE-2017-18421: cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). Unscored

  cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

  Updated 2024-08-05
• CVE-2017-18420: cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269). Unscored

  cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).

  Updated 2024-08-05
• CVE-2017-18419: cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266). Unscored

  cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).

  Updated 2024-08-05
• CVE-2017-18418: cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265). Unscored

  cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).

  Updated 2024-08-05
• CVE-2017-18417: cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263). Unscored

  cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).

  Updated 2024-08-05
• CVE-2017-18416: cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). Unscored

  cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).

  Updated 2024-08-05
• CVE-2017-18415: cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). Unscored

  cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).

  Updated 2024-08-05
• CVE-2017-18414: cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). Unscored

  cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).

  Updated 2024-08-05
• CVE-2017-18413: In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299). Unscored

  In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).

  Updated 2024-08-05
• CVE-2017-18412: cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). Unscored

  cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).

  Updated 2024-08-05
• CVE-2017-18411: The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). Unscored

  The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).

  Updated 2024-08-05
• CVE-2017-18410: In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). Unscored

  In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).

  Updated 2024-08-05
• CVE-2017-18409: In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). Unscored

  In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

  Updated 2024-08-05
• CVE-2017-18408: cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). Unscored

  cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).

  Updated 2024-08-05
• CVE-2017-18407: cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279). Unscored

  cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

  Updated 2024-08-05
• CVE-2017-18406: cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). Unscored

  cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).

  Updated 2024-08-05

Search a CVE ID or check dependency files →