Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2013-7473

    Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.

  • Unscored —
    CVE-2018-20902

    cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

  • Unscored —
    CVE-2018-20901

    cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

  • Unscored —
    CVE-2013-7474

    Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter t…

  • Unscored —
    CVE-2019-14472

    Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.

  • Unscored —
    CVE-2019-14471

    TestLink 1.9.19 has XSS via the error.php message parameter.

  • Unscored —
    CVE-2018-20900

    cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

  • Unscored —
    CVE-2018-20899

    cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

  • Unscored —
    CVE-2018-20898

    cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

  • Unscored —
    CVE-2018-20897

    cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

  • Unscored —
    CVE-2018-20896

    cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

  • High 7.2
    CVE-2019-0193 Exploited Public exploit Scanner template EPSS 84%

    XML External Entity (XXE) Injection in Apache Solr

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

    Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Unscored —
    CVE-2018-20895

    In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-3…

  • High 7.4
    CVE-2014-8183

    It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on cer…

    The Foreman Project foreman
  • High 8.1
    CVE-2018-10899

    Cross-Site Request Forgery in Jolokia

    A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code E…

    jolokia jolokia org.jolokia:jolokia-core Maven
  • High 8.1
    CVE-2019-3890

    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse …

    The Gnome Project evolution-ews evolution-ews evolution-ews Debian Ubuntu
  • Low 3.6
    CVE-2019-3884

    A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a va…

    Red Hat atomic-openshift
  • Unscored —
    CVE-2018-20894

    cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

  • Unscored —
    CVE-2018-20893

    cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

  • Unscored —
    CVE-2018-20892

    cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

  • Unscored —
    CVE-2018-20891

    cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

  • Unscored —
    CVE-2018-20890

    cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

  • Unscored —
    CVE-2018-20889

    cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

  • Unscored —
    CVE-2018-20888

    cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authenticati…

  • Unscored —
    CVE-2018-20887

    cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

  • Unscored —
    CVE-2018-20886

    cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

  • Unscored —
    CVE-2018-20885

    cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (…

  • Unscored —
    CVE-2018-20884

    cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

  • Unscored —
    CVE-2019-14468

    GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.

    gnucobol gnucobol Debian Ubuntu
  • Unscored —
    CVE-2018-20883

    cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

  • Unscored —
    CVE-2018-20882

    cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Passwor…

  • Unscored —
    CVE-2018-20881

    cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

  • Unscored —
    CVE-2018-20880

    cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

  • Unscored —
    CVE-2018-20879

    cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

  • Unscored —
    CVE-2018-20878

    cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

  • Unscored —
    CVE-2018-20877

    cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

  • Unscored —
    CVE-2018-20876

    cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

  • Unscored —
    CVE-2018-20875

    cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

  • Unscored —
    CVE-2018-20874

    cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).

  • Unscored —
    CVE-2018-20873

    cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).