Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2017-18444

    cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

  • Unscored —
    CVE-2017-18443

    cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

  • Unscored —
    CVE-2017-18442

    cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).

  • Unscored —
    CVE-2017-18441

    cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

  • Unscored —
    CVE-2017-18440

    cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).

  • Unscored —
    CVE-2017-18439

    cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

  • Unscored —
    CVE-2017-18438

    cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

  • Unscored —
    CVE-2017-18437

    cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).

  • Unscored —
    CVE-2017-18436

    cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).

  • Unscored —
    CVE-2019-10961

    In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper v…

  • Unscored —
    CVE-2017-18435

    cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

  • Unscored —
    CVE-2017-18434

    cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang a…

  • Unscored —
    CVE-2017-18433

    cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).

  • Unscored —
    CVE-2017-18432

    In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

  • Unscored —
    CVE-2017-18431

    cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).

  • Unscored —
    CVE-2017-18430

    In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-…

  • Unscored —
    CVE-2017-18429

    In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

  • High 8.8
    CVE-2019-9141

    Zoneplayer ActiveX Remote Code Execution vulnerability

    ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for remote code execution.

    IMGTech Co,Ltd ZInsVX.dll ActiveX Control
  • Unscored —
    CVE-2017-18428

    In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).

  • Unscored —
    CVE-2017-18427

    In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

  • Unscored —
    CVE-2017-18426

    cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).

  • Unscored —
    CVE-2017-18425

    In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).

  • Unscored —
    CVE-2017-18424

    In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).

  • Unscored —
    CVE-2017-18423

    In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

  • Unscored —
    CVE-2017-18422

    In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).

  • Unscored —
    CVE-2017-18421

    cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

  • Unscored —
    CVE-2017-18420

    cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).

  • Unscored —
    CVE-2017-18419

    cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).

  • Unscored —
    CVE-2017-18418

    cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).

  • Unscored —
    CVE-2017-18417

    cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).

  • Unscored —
    CVE-2019-5501

    Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthentic…

    NETAPP Data ONTAP operating in 7-Mode
  • Unscored —
    CVE-2019-5493

    Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information…

    NETAPP Data ONTAP operating in 7-Mode
  • High 7.5
    CVE-2019-14235

    Uncontrolled Recursion in Django

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 oc…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-14233

    Django Denial-of-service in strip_tags()

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.1
    CVE-2018-1987

    IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect no…

    IBM Spectrum Protect for Enterprise Resource Planning
  • Medium 6.2
    CVE-2019-4275

    IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique cat…

    IBM Jazz for Service Management
  • Unscored —
    CVE-2019-14531

    An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System U…

    sleuthkit sleuthkit Debian Ubuntu
  • Unscored —
    CVE-2019-14532

    An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/ha…

    sleuthkit sleuthkit Debian Ubuntu
  • Unscored —
    CVE-2019-10938

    A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 de…

    Siemens SIPROTEC 5 devices with CPU variants CP200 Siemens Power Meters Series 9410 SIPROTEC 5 devices with CPU variants CP300 and CP100 ICS / OT
  • Unscored —
    CVE-2017-18416

    cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).