Skip to content
OpenAdvisories

Archive

1 August 2019

Vulnerabilities first published on this day (UTC), newest first.

← July 2019 2019 / August /1 September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

162 results · Feed

  • Unscored —
    CVE-2016-10850

    cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).

  • Unscored —
    CVE-2018-20923

    cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).

  • Unscored —
    CVE-2018-20922

    cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).

  • Unscored —
    CVE-2018-20921

    cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).

  • Unscored —
    CVE-2018-20920

    cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).

  • Unscored —
    CVE-2018-20919

    cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).

  • Unscored —
    CVE-2016-10851

    cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).

  • Unscored —
    CVE-2018-20918

    cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).

  • Unscored —
    CVE-2016-10852

    cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

  • Unscored —
    CVE-2018-20917

    cPanel before 70.0.23 allows any user to disable Solr (SEC-371).

  • Unscored —
    CVE-2018-20916

    cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).

  • Unscored —
    CVE-2018-20915

    cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).

  • Unscored —
    CVE-2016-10853

    cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).

  • Unscored —
    CVE-2018-20914

    In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).

  • Unscored —
    CVE-2019-14259

    On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in …

  • Unscored —
    CVE-2016-10854

    cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).

  • Unscored —
    CVE-2018-20913

    cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).

  • Unscored —
    CVE-2018-20912

    cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).

  • Unscored —
    CVE-2016-10855

    cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

  • Unscored —
    CVE-2018-20911

    cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).

  • Unscored —
    CVE-2016-10856

    cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

  • Unscored —
    CVE-2016-10857

    cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

  • Unscored —
    CVE-2016-10858

    cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).

  • Unscored —
    CVE-2016-10859

    cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).

  • Unscored —
    CVE-2019-13572

    The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.

  • Unscored —
    CVE-2016-10860

    cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

  • Unscored —
    CVE-2015-9291

    cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1…

  • Unscored —
    CVE-2018-20910

    cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).

  • Unscored —
    CVE-2018-20909

    cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

  • Unscored —
    CVE-2018-20908

    cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).

  • Unscored —
    CVE-2018-20907

    cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

  • Unscored —
    CVE-2018-20906

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

  • Unscored —
    CVE-2018-20905

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).

  • Unscored —
    CVE-2018-20904

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

  • Unscored —
    CVE-2018-20903

    cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).

  • Unscored —
    CVE-2013-7473

    Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.

  • Unscored —
    CVE-2018-20902

    cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

  • Unscored —
    CVE-2018-20901

    cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

  • Unscored —
    CVE-2013-7474

    Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter t…

  • Unscored —
    CVE-2019-14472

    Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.