DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).

The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).

The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).

cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).

cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).

guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).

cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).

cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).

In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).

cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).

cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).

cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

cPanel before 68.0.15 does not block a username of ssl (SEC-328).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).

In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).

cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).

cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).

The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).

In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).

cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).

cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).

cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).