Skip to content
OpenAdvisories

Archive

30 July 2019

Vulnerabilities first published on this day (UTC), newest first.

← June 2019 2019 / July /30 August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

95 results · Feed

  • Low 3.1
    CVE-2019-10130

    A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, exc…

    PostgreSQL postgresql postgresql15 postgresql-9.5 Ubuntu Alpine
  • Medium 6.5
    CVE-2019-10129

    A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned ta…

    PostgreSQL postgresql postgresql15 postgresql14 Alpine
  • Critical 9.8
    CVE-2019-11202

    Rancher Recreates Default User With Known Password Despite Deletion

    An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial …

    github.com/rancher/rancher Go
  • Unscored —
    CVE-2018-20870

    The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

  • Unscored —
    CVE-2018-20869

    cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).

  • Unscored —
    CVE-2018-20862

    cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).

  • Unscored —
    CVE-2018-20868

    cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

  • Unscored —
    CVE-2018-20866

    cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

  • Unscored —
    CVE-2018-20865

    cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).

  • Unscored —
    CVE-2018-20864

    cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

  • Unscored —
    CVE-2018-20863

    cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

  • Unscored —
    CVE-2019-14414

    In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

  • Unscored —
    CVE-2019-14413

    cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

  • Unscored —
    CVE-2019-14412

    Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

  • Unscored —
    CVE-2019-14411

    cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

  • Unscored —
    CVE-2019-14410

    Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

  • Unscored —
    CVE-2019-14409

    cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

  • Unscored —
    CVE-2019-14408

    cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

  • Unscored —
    CVE-2019-14407

    cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

  • Unscored —
    CVE-2019-14406

    cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

  • Unscored —
    CVE-2019-14405

    cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).

  • Unscored —
    CVE-2019-14404

    cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_…

  • Unscored —
    CVE-2019-14403

    cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

  • Unscored —
    CVE-2019-14402

    cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).

  • Unscored —
    CVE-2019-14401

    cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).

  • Unscored —
    CVE-2019-14400

    cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).

  • Unscored —
    CVE-2019-14399

    The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root a…

  • Unscored —
    CVE-2019-14398

    cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).

  • Unscored —
    CVE-2019-14397

    cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).

  • Unscored —
    CVE-2019-14396

    API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).

  • Unscored —
    CVE-2019-14395

    cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).

  • Unscored —
    CVE-2019-14394

    cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_fo…

  • Unscored —
    CVE-2019-14393

    cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp…

  • Unscored —
    CVE-2019-14392

    cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).

  • Unscored —
    CVE-2018-20867

    cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

  • Unscored —
    CVE-2019-11775

    All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is…

    The Eclipse Foundation Eclipse OpenJ9
  • High 7.1
    CVE-2019-4456

    IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (X…

    IBM Daeja ViewONE
  • Medium 5.4
    CVE-2019-4285

    IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of …

    IBM WebSphere Application Server
  • High 7.1
    CVE-2019-4062

    IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack …

    IBM i2 Analyst's Notebook
  • Unscored —
    CVE-2019-14391

    cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).