cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).

cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call (SEC-236).

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call (SEC-237).

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules (SEC-213).

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call (SEC-243).

cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call (SEC-252).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API (SEC-251).

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft (SEC-294).

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite (SEC-254).

cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).