CVE-2017-18476

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-184776.5In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).CVE-2017-184786.5In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).CVE-2017-184796.5In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).CVE-2017-184806.5cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).CVE-2017-184815.4cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).CVE-2017-184826.5cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).CVE-2017-184836.1ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.CVE-2017-184846.1Cognitoys Dino devices allow XSS via the SSID.CVE-2017-184855.4Cognitoys Dino devices allow profiles_add.html CSRF.CVE-2017-184867.2Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter.CVE-2017-184876.1The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.CVE-2017-184886.1The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
CVE-2017-18476: High severity, CVSS 7.5 | Vulnix