cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).

cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).