Skip to content
OpenAdvisories

Archive

July 2019

Vulnerabilities first published in this month (UTC), newest first.

← June 2019 2019 / July August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

1,623 results · Feed

  • Unscored —
    CVE-2019-14407

    cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

  • Unscored —
    CVE-2019-14406

    cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

  • Unscored —
    CVE-2019-14405

    cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).

  • Unscored —
    CVE-2019-14404

    cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_…

  • Unscored —
    CVE-2019-14403

    cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

  • Unscored —
    CVE-2019-14402

    cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).

  • Unscored —
    CVE-2019-14401

    cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).

  • Unscored —
    CVE-2019-14400

    cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).

  • Unscored —
    CVE-2019-14399

    The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root a…

  • Unscored —
    CVE-2019-14398

    cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).

  • Unscored —
    CVE-2019-14397

    cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).

  • Unscored —
    CVE-2019-14396

    API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).

  • Unscored —
    CVE-2019-14395

    cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).

  • Unscored —
    CVE-2019-14394

    cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_fo…

  • Unscored —
    CVE-2019-14393

    cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp…

  • Unscored —
    CVE-2019-14392

    cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).

  • Unscored —
    CVE-2018-20867

    cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

  • Unscored —
    CVE-2019-11775

    All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is…

    The Eclipse Foundation Eclipse OpenJ9
  • High 7.1
    CVE-2019-4456

    IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (X…

    IBM Daeja ViewONE
  • Medium 5.4
    CVE-2019-4285

    IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of …

    IBM WebSphere Application Server
  • High 7.1
    CVE-2019-4062

    IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack …

    IBM i2 Analyst's Notebook
  • Unscored —
    CVE-2019-14391

    cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).

  • Unscored —
    CVE-2019-14390

    cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).

  • Unscored —
    CVE-2019-14389

    cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).

  • Unscored —
    CVE-2019-14388

    cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).

  • Unscored —
    CVE-2019-14387

    cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).

  • Unscored —
    CVE-2019-14381

    libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument…

    libopenmpt Debian
  • Unscored —
    CVE-2019-14386

    cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).

  • Unscored —
    CVE-2015-9290

    In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is n…

    freetype Debian
  • Unscored —
    CVE-2017-18380

    edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has a…

  • Unscored —
    CVE-2019-14327

    A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change th…

  • Unscored —
    CVE-2019-13635 EPSS 44%

    The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Travers…

  • Unscored —
    CVE-2019-14444

    apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a wri…

    binutils binutils Debian Ubuntu
  • Unscored —
    CVE-2019-14443

    An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote a…

    libav Ubuntu
  • Unscored —
    CVE-2019-14442

    In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and han…

    libav Ubuntu
  • Unscored —
    CVE-2019-14441

    An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (applic…

  • High 7.5
    CVE-2019-14439 Public exploit EPSS 11%

    Deserialization of untrusted data in FasterXML jackson-databind

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in …

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Unscored —
    CVE-2018-18570 Scanner template

    Planon before Live Build 41 has XSS.

  • Unscored —
    CVE-2019-3948 Public exploit EPSS 25%

    The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.…

  • Critical 9.8
    CVE-2019-14431

    In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-base…