Search Results (Refine Search)
- Results Type: Overview
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2017-18396 |
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). Published: August 02, 2019; 10:15:12 AM -0400 |
V4.0:(not available) V3.0: 5.5 MEDIUM V2.0: 4.9 MEDIUM |
CVE-2017-18395 |
cPanel before 68.0.15 does not block a username of ssl (SEC-328). Published: August 02, 2019; 10:15:12 AM -0400 |
V4.0:(not available) V3.0: 2.7 LOW V2.0: 4.0 MEDIUM |
CVE-2017-18394 |
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). Published: August 02, 2019; 10:15:12 AM -0400 |
V4.0:(not available) V3.0: 2.7 LOW V2.0: 4.0 MEDIUM |
CVE-2017-18393 |
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). Published: August 02, 2019; 10:15:12 AM -0400 |
V4.0:(not available) V3.0: 2.7 LOW V2.0: 4.0 MEDIUM |
CVE-2017-18392 |
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). Published: August 02, 2019; 10:15:12 AM -0400 |
V4.0:(not available) V3.0: 2.0 LOW V2.0: 2.1 LOW |
CVE-2019-10168 |
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Published: August 02, 2019; 9:15:12 AM -0400 |
V4.0:(not available) V3.1: 7.8 HIGH V2.0: 4.6 MEDIUM |
CVE-2019-10167 |
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Published: August 02, 2019; 9:15:12 AM -0400 |
V4.0:(not available) V3.1: 7.8 HIGH V2.0: 4.6 MEDIUM |
CVE-2019-10166 |
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. Published: August 02, 2019; 9:15:12 AM -0400 |
V4.0:(not available) V3.1: 7.8 HIGH V2.0: 4.6 MEDIUM |
CVE-2017-18391 |
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 2.5 LOW V2.0: 1.9 LOW |
CVE-2017-18390 |
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 7.8 HIGH V2.0: 7.2 HIGH |
CVE-2017-18389 |
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 6.3 MEDIUM V2.0: 6.5 MEDIUM |
CVE-2017-18388 |
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 7.8 HIGH V2.0: 7.2 HIGH |
CVE-2017-18387 |
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 7.2 HIGH V2.0: 9.0 HIGH |
CVE-2017-18386 |
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 7.2 HIGH V2.0: 9.0 HIGH |
CVE-2017-18385 |
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 5.5 MEDIUM V2.0: 2.1 LOW |
CVE-2017-18384 |
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 3.8 LOW V2.0: 2.1 LOW |
CVE-2017-18383 |
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 7.8 HIGH V2.0: 4.6 MEDIUM |
CVE-2017-18382 |
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.0: 2.7 LOW V2.0: 4.0 MEDIUM |
CVE-2014-8184 |
A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened. Published: August 02, 2019; 9:15:11 AM -0400 |
V4.0:(not available) V3.1: 7.8 HIGH V2.0: 6.8 MEDIUM |
CVE-2019-14524 |
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465. Published: August 02, 2019; 8:15:12 AM -0400 |
V4.0:(not available) V3.1: 7.8 HIGH V2.0: 6.8 MEDIUM |