alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2017-18371 (published 2019-05-02)
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: billion, zyxel
Affected products: 5200w-t, 5200w-t_firmware, p660hn-t1a_v1, p660hn-t1a_v1_firmware, p660hn-t1a_v2, p660hn-t1a_v2_firmware
CVE-2017-18372 (published 2019-05-02)
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: billion, zyxel
Affected products: 5200w-t, 5200w-t_firmware, p660hn-t1a_v1, p660hn-t1a_v1_firmware, p660hn-t1a_v2, p660hn-t1a_v2_firmware
CVE-2017-18373 (published 2019-05-02)
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: billion
Affected products: 5200w-t, 5200w-t_firmware
CVE-2017-18374 (published 2019-05-02)
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface, exploit authenticated command injections and change router settings for malicious purposes.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: billion, zyxel
Affected products: 5200w-t, 5200w-t_firmware, p660hn-t1a_v1, p660hn-t1a_v1_firmware, p660hn-t1a_v2, p660hn-t1a_v2_firmware
CVE-2017-18375 (published 2019-05-24)
Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: ampache
Affected products: ampache
CVE-2017-18376 (published 2019-06-02)
An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: strangebee
Affected products: thehive
CVE-2017-18377 (published 2019-06-11)
An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp URI.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: goahead
Affected products: wireless_ip_camera_wificam, wireless_ip_camera_wificam_firmware
CVE-2017-18378 (published 2019-06-11)
In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_dir, leading to upgrade_handle.php?cmd=writeuploaddir remote command execution.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: netgear
Affected products: readynas_surveillance, readynas_surveillance_firmware
CVE-2017-18379 (published 2019-07-27)
In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: linux
Affected products: linux_kernel
CVE-2017-18380 (published 2019-07-30)
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: edx
Affected products: edx-platform
CVE-2017-18381 (published 2019-07-30)
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: edx
Affected products: edx-platform
CVE-2017-18382 (published 2019-08-02)
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18383 (published 2019-08-02)
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18384 (published 2019-08-02)
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18385 (published 2019-08-02)
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18386 (published 2019-08-02)
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18387 (published 2019-08-02)
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18388 (published 2019-08-02)
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18389 (published 2019-08-02)
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18390 (published 2019-08-02)
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18391 (published 2019-08-02)
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18392 (published 2019-08-02)
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18393 (published 2019-08-02)
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18394 (published 2019-08-02)
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18395 (published 2019-08-02)
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18396 (published 2019-08-02)
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18397 (published 2019-08-02)
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18398 (published 2019-08-02)
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18399 (published 2019-08-02)
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18400 (published 2019-08-02)
cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18401 (published 2019-08-02)
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18402 (published 2019-08-02)
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18403 (published 2019-08-02)
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18404 (published 2019-08-02)
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18405 (published 2019-08-02)
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18406 (published 2019-08-02)
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-89
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18407 (published 2019-08-02)
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-347
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18408 (published 2019-08-02)
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18409 (published 2019-08-02)
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18410 (published 2019-08-02)
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18411 (published 2019-08-02)
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18412 (published 2019-08-02)
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18413 (published 2019-08-02)
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18414 (published 2019-08-02)
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)
Weakness: CWE-601
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18415 (published 2019-08-02)
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18416 (published 2019-08-02)
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18417 (published 2019-08-02)
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18418 (published 2019-08-02)
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18419 (published 2019-08-02)
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18420 (published 2019-08-02)
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18421 (published 2019-08-02)
cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18422 (published 2019-08-02)
In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18423 (published 2019-08-02)
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18424 (published 2019-08-02)
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18425 (published 2019-08-02)
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18426 (published 2019-08-02)
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18427 (published 2019-08-02)
In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18428 (published 2019-08-02)
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18429 (published 2019-08-02)
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18430 (published 2019-08-02)
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18431 (published 2019-08-02)
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18432 (published 2019-08-02)
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18433 (published 2019-08-02)
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18434 (published 2019-08-02)
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18435 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-434
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18436 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18437 (published 2019-08-02)
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18438 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-611
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18439 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18440 (published 2019-08-02)
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18441 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
Weakness: CWE-601
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18442 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-77
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18443 (published 2019-08-02)
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18444 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18445 (published 2019-08-02)
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18446 (published 2019-08-02)
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-125
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18447 (published 2019-08-02)
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18448 (published 2019-08-02)
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18449 (published 2019-08-02)
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18450 (published 2019-08-02)
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18451 (published 2019-08-02)
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18452 (published 2019-08-02)
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18453 (published 2019-08-02)
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18454 (published 2019-08-02)
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18455 (published 2019-08-02)
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-264
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18456 (published 2019-08-02)
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18457 (published 2019-08-02)
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18458 (published 2019-08-02)
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18459 (published 2019-08-02)
cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18460 (published 2019-08-02)
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18461 (published 2019-08-02)
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18462 (published 2019-08-05)
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18463 (published 2019-08-02)
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18464 (published 2019-08-05)
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18465 (published 2019-08-05)
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18466 (published 2019-08-05)
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18467 (published 2019-08-05)
cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18468 (published 2019-08-05)
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-94
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18469 (published 2019-08-05)
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18470 (published 2019-08-05)
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-255
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18471 (published 2019-08-05)
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18472 (published 2019-08-05)
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18473 (published 2019-08-05)
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18474 (published 2019-08-05)
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18475 (published 2019-08-05)
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18476 (published 2019-08-05)
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18477 (published 2019-08-05)
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18478 (published 2019-08-05)
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18479 (published 2019-08-05)
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18480 (published 2019-08-05)
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-254
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18481 (published 2019-08-05)
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18482 (published 2019-08-05)
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2017-18483 (published 2019-08-07)
ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: annke
Affected products: sp1, sp1_firmware
CVE-2017-18484 (published 2019-08-08)
Cognitoys Dino devices allow XSS via the SSID.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: elementalpath
Affected products: cognitoys_dino, cognitoys_dino_firmware
CVE-2017-18485 (published 2019-08-08)
Cognitoys Dino devices allow profiles_add.html CSRF.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-352
Affected vendors: elementalpath
Affected products: cognitoys_dino, cognitoys_dino_firmware
CVE-2017-18486 (published 2019-08-09)
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-332
Affected vendors: jitbit
Affected products: helpdesk
CVE-2017-18487 (published 2019-08-13)
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: google_adsense_project
Affected products: google_adsense
CVE-2017-18488 (published 2019-08-13)
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: backup-guard
Affected products: backup_guard
CVE-2017-18489 (published 2019-08-13)
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mediaburst
Affected products: contact_form_7_-_clockwork_sms
CVE-2017-18490 (published 2019-08-13)
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: contact_form_multi
CVE-2017-18491 (published 2019-08-13)
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: contact_form
CVE-2017-18492 (published 2019-08-13)
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: contact_form_to_db
CVE-2017-18493 (published 2019-08-13)
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: custom_admin_page
CVE-2017-18494 (published 2019-08-13)
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: custom_search
CVE-2017-18495 (published 2019-08-13)
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mediaburst
Affected products: gravity_forms
CVE-2017-18496 (published 2019-08-13)
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: htaccess
CVE-2017-18497 (published 2019-08-13)
The liveforms plugin before 3.4.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: w3eden
Affected products: live_forms
CVE-2017-18498 (published 2019-08-13)
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: presstigers
Affected products: simple_job_board
CVE-2017-18499 (published 2019-08-12)
The simple-membership plugin before 3.5.7 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: simple-membership-plugin
Affected products: simple_membership
CVE-2017-18500 (published 2019-08-12)
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: social_buttons_pack
CVE-2017-18501 (published 2019-08-12)
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: social_login
CVE-2017-18502 (published 2019-08-12)
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: subscriber
CVE-2017-18503 (published 2019-08-12)
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpdeveloper
Affected products: twitter_cards_meta
CVE-2017-18504 (published 2019-08-12)
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpdeveloper
Affected products: twitter_cards_meta
CVE-2017-18505 (published 2019-08-12)
The twitter-plugin plugin before 2.55 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: twitter_button
CVE-2017-18506 (published 2019-08-12)
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpovernight
Affected products: woocommerce_pdf_invoices\&_packing_slips
CVE-2017-18507 (published 2019-08-13)
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 3cx
Affected products: live_chat
CVE-2017-18508 (published 2019-08-12)
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 3cx
Affected products: live_chat
CVE-2017-18509 (published 2019-08-13)
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: canonical, debian, linux
Affected products: debian_linux, linux_kernel, ubuntu_linux
CVE-2017-18510 (published 2019-08-14)
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpmudev
Affected products: custom_sidebars
CVE-2017-18511 (published 2019-08-14)
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpmudev
Affected products: custom_sidebars
CVE-2017-18512 (published 2019-08-14)
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: supsystic
Affected products: newsletter_by_supsystic
CVE-2017-18513 (published 2019-08-14)
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: expresstech
Affected products: responsive_menu
CVE-2017-18514 (published 2019-08-14)
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: simplerealtytheme
Affected products: simple_login_log
CVE-2017-18515 (published 2019-08-14)
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: veronalabs
Affected products: wp_statistics
CVE-2017-18516 (published 2019-08-21)
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: linkedin
CVE-2017-18517 (published 2019-08-20)
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: pinterest
CVE-2017-18518 (published 2019-08-20)
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: smtp
CVE-2017-18519 (published 2019-08-20)
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: marvinlabs
Affected products: wp_customer_area
CVE-2017-18520 (published 2019-08-20)
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp-kama
Affected products: democracy_poll
CVE-2017-18521 (published 2019-08-21)
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wp-kama
Affected products: democracy_poll
CVE-2017-18522 (published 2019-08-20)
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eelv_newsletter_project
Affected products: eelv_newsletter
CVE-2017-18523 (published 2019-08-20)
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: eelv_newsletter_project
Affected products: eelv_newsletter
CVE-2017-18524 (published 2019-08-20)
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: antoineh
Affected products: football_pool
CVE-2017-18525 (published 2019-08-21)
The megamenu plugin before 2.4 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: megamenu
Affected products: max_mega_menu
CVE-2017-18526 (published 2019-08-20)
The moreads-se plugin before 1.4.7 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: lamp-solutions
Affected products: moreads_se
CVE-2017-18527 (published 2019-08-20)
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: pagination
CVE-2017-18528 (published 2019-08-20)
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: pdf_\&_print
CVE-2017-18529 (published 2019-08-20)
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: promobar