Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2017-18415

    cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-…

  • Unscored —
    CVE-2017-18414

    cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).

  • Unscored —
    CVE-2017-18413

    In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).

  • Medium 4.2
    CVE-2019-10176

    A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster…

    Red Hat atomic-openshift
  • Unscored —
    CVE-2017-18412

    cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an acc…

  • Unscored —
    CVE-2017-18411

    The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC…

  • High 7.5
    CVE-2019-10171

    It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied …

    Red Hat 389-ds-base
  • Unscored —
    CVE-2017-18410

    In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).

  • Unscored —
    CVE-2017-18409

    In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

  • Unscored —
    CVE-2017-18408

    cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).

  • Unscored —
    CVE-2017-18407

    cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

  • Unscored —
    CVE-2019-14529 Public exploit EPSS 28%

    OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.

  • Unscored —
    CVE-2017-18406

    cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).

  • Unscored —
    CVE-2019-14528

    GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.

    gnucobol gnucobol open-cobol Debian Ubuntu
  • Unscored —
    CVE-2017-18405

    cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345…

  • Unscored —
    CVE-2017-18404

    cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).

  • Unscored —
    CVE-2017-18403

    cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

  • Unscored —
    CVE-2017-18402

    cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).

  • Unscored —
    CVE-2017-18401

    cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).

  • Unscored —
    CVE-2017-18400

    cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).

  • Unscored —
    CVE-2017-18399

    cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabl…

  • Unscored —
    CVE-2017-18398

    DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).

  • Unscored —
    CVE-2017-18397

    cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).

  • Unscored —
    CVE-2017-18396

    cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).

  • Unscored —
    CVE-2017-18395

    cPanel before 68.0.15 does not block a username of ssl (SEC-328).

  • Unscored —
    CVE-2017-18394

    cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).

  • Unscored —
    CVE-2017-18393

    cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).

  • Unscored —
    CVE-2017-18392

    cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).

  • Unscored —
    CVE-2017-18391

    cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interva…

  • Unscored —
    CVE-2017-18390

    cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on increment…

  • Unscored —
    CVE-2017-18389

    cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).

  • Unscored —
    CVE-2017-18388

    cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).

  • Unscored —
    CVE-2017-18387

    cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).

  • Unscored —
    CVE-2017-18386

    cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).

  • Unscored —
    CVE-2017-18385

    cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).

  • Unscored —
    CVE-2017-18384

    cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).

  • Unscored —
    CVE-2017-18383

    cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).

  • Unscored —
    CVE-2017-18382

    cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).

  • High 8.8
    CVE-2019-10168

    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x …

    libvirt libvirt libvirt libvirt Debian Alpine
  • High 8.8
    CVE-2019-10167

    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emu…

    libvirt libvirt libvirt libvirt Debian Ubuntu Alpine