U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:cpanel:cpanel:62.0.46:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 121 matching records.
Displaying matches 61 through 80.
Vuln ID Summary CVSS Severity
CVE-2018-20900

cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

Published: August 01, 2019; 10:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20899

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2018-20898

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20897

cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 2.8 LOW
V2.0: 3.3 LOW
CVE-2018-20896

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

Published: August 01, 2019; 10:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.9 LOW
V2.0: 3.3 LOW
CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

Published: August 01, 2019; 10:15:11 AM -0400 		V4.0:(not available)
 V3.0: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM
CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20883

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

Published: August 01, 2019; 9:15:13 AM -0400 		V4.0:(not available)
 V3.0: 6.5 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2018-20881

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20880

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2018-20879

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 6.3 MEDIUM
V2.0: 6.5 MEDIUM
CVE-2018-20878

cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20877

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20876

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2018-20875

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

Published: August 01, 2019; 9:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW
CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 4.3 MEDIUM
V2.0: 4.0 MEDIUM
CVE-2019-14412

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 2.1 LOW
CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

Published: July 30, 2019; 11:15:12 AM -0400 		V4.0:(not available)
 V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM