Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
-
Unscored —
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
-
Unscored —
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
-
Unscored —
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system…
-
Unscored —
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
-
Unscored —
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
-
Unscored —
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
-
Unscored —
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
-
Unscored —
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
-
Unscored —
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
-
Unscored —
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
-
Unscored —
cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
-
Unscored —
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
-
Unscored —
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configur…
-
Unscored —
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
-
Unscored —
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
-
Unscored —
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of f…
-
Unscored —
In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system admi…
-
Unscored —
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
-
Unscored —
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
-
Unscored —
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filt…
-
Medium 6.1
Cross-site Scripting in pandao
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
-
Unscored —
Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origi…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento a…
-
High 7.5
Magento 2 Community Edition Information Leak
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak custom…
-
High 7.5
Magento 2 Community Edition Access Control Bypass
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby g…
-
Medium 6.5
Magento 2 Community Edition CSRF vulnerability
A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
-
Medium 5.4
Magento 2 Community Edition XSS Vulnerability
A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to m…
-
Medium 5.4
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authentic…
-
High 7.2
Magento 2 Community Edition RCE
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout up…
-
Unscored —
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Mage…
-
Medium 6.1
Magento Reflected cross-site scripting on customer cart page
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in maliciou…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to injec…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to in…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited…
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited…
-
High 7.2
Magento 2 Community Edition RCE Vulnerability
A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to c…
-
High 7.2
Magento 2 Community Unrestricted File Upload
A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting…
-
Medium 4.9
Magento 2 Community Edition Information Disclosure
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administra…