Skip to content
OpenAdvisories

Archive

2 August 2019

Vulnerabilities first published on this day (UTC), newest first.

← July 2019 2019 / August /2 September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

182 results · Feed

  • Unscored —
    CVE-2017-18461

    cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

  • Unscored —
    CVE-2017-18460

    cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).

  • Unscored —
    CVE-2017-18459

    cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).

  • Unscored —
    CVE-2017-18458

    cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

  • Unscored —
    CVE-2017-18457

    cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

  • Unscored —
    CVE-2017-18456

    cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).

  • Unscored —
    CVE-2017-18455

    In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).

  • Unscored —
    CVE-2017-18454

    cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).

  • Unscored —
    CVE-2017-18453

    cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

  • Unscored —
    CVE-2017-18452

    cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).

  • Unscored —
    CVE-2017-18451

    cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrad…

  • Unscored —
    CVE-2017-18450

    cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).

  • Unscored —
    CVE-2017-18449

    cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roun…

  • Unscored —
    CVE-2017-18448

    cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).

  • Unscored —
    CVE-2017-18447

    cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

  • Unscored —
    CVE-2017-18446

    cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

  • Unscored —
    CVE-2017-18445

    cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

  • Unscored —
    CVE-2017-18444

    cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

  • Unscored —
    CVE-2017-18443

    cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

  • Unscored —
    CVE-2017-18442

    cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).

  • Unscored —
    CVE-2017-18441

    cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

  • Unscored —
    CVE-2017-18440

    cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).

  • Unscored —
    CVE-2017-18439

    cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

  • Unscored —
    CVE-2017-18438

    cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

  • Unscored —
    CVE-2017-18437

    cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

  • Unscored —
    CVE-2017-18436

    cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).

  • Unscored —
    CVE-2019-10961

    In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper v…

  • Unscored —
    CVE-2017-18435

    cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

  • Unscored —
    CVE-2017-18434

    cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang a…

  • Unscored —
    CVE-2017-18433

    cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).

  • Unscored —
    CVE-2017-18432

    In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

  • Unscored —
    CVE-2017-18431

    cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).

  • Unscored —
    CVE-2017-18430

    In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-…

  • Unscored —
    CVE-2017-18429

    In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

  • High 8.8
    CVE-2019-9141

    Zoneplayer ActiveX Remote Code Execution vulnerability

    ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for remote code execution.

    IMGTech Co,Ltd ZInsVX.dll ActiveX Control
  • Unscored —
    CVE-2017-18428

    In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).

  • Unscored —
    CVE-2017-18427

    In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

  • Unscored —
    CVE-2017-18426

    cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).

  • Unscored —
    CVE-2017-18425

    In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).

  • Unscored —
    CVE-2017-18424

    In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).