U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:cpanel:cpanel:61.9999.65:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 230 matching records.
Displaying matches 161 through 180.
Vuln ID Summary CVSS Severity
CVE-2018-20910

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 7.1 HIGH
V2.0: 3.6 LOW
CVE-2018-20908

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.5 MEDIUM
V2.0: 2.1 LOW
CVE-2018-20907

cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20906

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20905

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 5.5 MEDIUM
CVE-2018-20904

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20903

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20902

cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

Published: August 01, 2019; 11:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.5 MEDIUM
V2.0: 2.1 LOW
CVE-2018-20901

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

Published: August 01, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20899

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20898

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20897

cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 2.8 LOW
V2.0: 3.3 LOW
CVE-2018-20896

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.9 LOW
V2.0: 3.3 LOW
CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

Published: August 01, 2019; 10:15:11 AM -0400 		V4.0:(not available)
 V3.0: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM
CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20883

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.5 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20880

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW