Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
High 7.8
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to …
-
High 7.8
A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTabl…
-
Unscored —
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_l…
-
Unscored —
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of…
-
High 7.5
Django Denial-of-service in django.utils.text.Truncator
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a…
-
Medium 6.1
Cross-site Scripting in pandao editor.md
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
-
Unscored —
A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss…
-
Unscored —
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that…
-
Unscored —
On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injecti…
-
Unscored —
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
-
Unscored —
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
-
Unscored —
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
-
Unscored —
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
-
Unscored —
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
-
Unscored —
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
-
Unscored —
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
-
Unscored —
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
-
Unscored —
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
-
Unscored —
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
-
Unscored —
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
-
Unscored —
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
-
High 7.8
Happypoint mobile application information disclosure vulnerability
When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by ent…
-
Medium 5.8
webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.
-
Unscored —
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
-
Unscored —
cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interp…
-
Unscored —
cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
-
Unscored —
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
-
Unscored —
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
-
Unscored —
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
-
Unscored —
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
-
Unscored —
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
-
Unscored —
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
-
Unscored —
cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).
-
Unscored —
cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).
-
Unscored —
cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).
-
Unscored —
cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).
-
Unscored —
cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
-
Unscored —
cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
-
Unscored —
cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).
-
Unscored —
cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the arch…