cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call (SEC-236).

cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call (SEC-237).

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call (SEC-243).

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call (SEC-252).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScannergetsocket API (SEC-251).

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassignpostterminatecruft (SEC-294).

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).

cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite (SEC-254).

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).

In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).

In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).

cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite (SEC-255).

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).