deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14197
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14198
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14199
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14200
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14201
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14202
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14203
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2019-14204
Published: 2019-07-31
Description: An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.semmle.com/uboot-rce-nfs-vulnerability/; https://gitlab.com/u-boot/u-boot; https://blog.semmle.com/uboot-rce-nfs-vulnerability/
CVE: CVE-2018-16860
Published: 2019-07-31
Description: A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358, CWE-358
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html; http://seclists.org/fulldisclosure/2019/Aug/11; http://seclists.org/fulldisclosure/2019/Aug/13
CVE: CVE-2019-13568
Published: 2019-07-31
Description: CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://cimg.eu/; https://github.com/dtschump/CImg; https://github.com/dtschump/CImg/commit/ac[PII_REDACTED]aba51048c9d67e[PII_REDACTED]b1d1
CVE: CVE-2019-4163
Published: 2019-07-31
Description: IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10960009; https://exchange.xforce.ibmcloud.com/vulnerabilities/158696; http://www.ibm.com/support/docview.wss?uid=ibm10960009
CVE: CVE-2019-4165
Published: 2019-07-31
Description: IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow a remote attacker to cause a denial of service attack using repeated requests to the server. IBM X-Force ID: 158698.
CVSS Score: 7.5 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10960131; https://exchange.xforce.ibmcloud.com/vulnerabilities/158698; http://www.ibm.com/support/docview.wss?uid=ibm10960131
CVE: CVE-2019-5020
Published: 2019-07-31
Description: An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617, CWE-754
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0781; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0781
CVE: CVE-2019-5057
Published: 2019-07-31
Description: An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
CVE: CVE-2019-5058
Published: 2019-07-31
Description: An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
CVE: CVE-2019-5059
Published: 2019-07-31
Description: An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
CVE: CVE-2019-5060
Published: 2019-07-31
Description: An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
CVE: CVE-2007-6763
Published: 2019-07-31
Description: SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back or forward button in a web browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://ftp.sas.com/techsup/download/hotfix/drugdev/32drg02/SDD_Release_Notes_32DRG02.pdf; http://ftp.sas.com/techsup/download/hotfix/drugdev/32drg02/SDD_Release_Notes_32DRG02.pdf
CVE: CVE-2018-20872
Published: 2019-07-31
Description: DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.draytek.com/about/security-advisory/urgent-security-updates-to-draytek-routers; https://www.draytek.com/about/security-advisory/urgent-security-updates-to-draytek-routers
CVE: CVE-2019-12750
Published: 2019-07-31
Description: Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/155581/Symantec-Endpoint-Protection-Information-Disclosure-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Dec/11; http://seclists.org/fulldisclosure/2019/Dec/21
CVE: CVE-2019-1901
Published: 2019-07-31
Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an adjacent, unauthenticated attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to the targeted device. A successful exploit may lead to a buffer overflow condition that could either cause a DoS condition or allow the attacker to execute arbitrary code with root privileges. Note: This vulnerability cannot be exploited by transit traffic through the device; the crafted packet must be targeted to a directly connected interface. This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI mode if they are running a Cisco Nexus 9000 Series ACI Mode Switch Software release prior to 13.2(7f) or any 14.x release.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190731-nxos-bo; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190731-nxos-bo
CVE: CVE-2019-3958
Published: 2019-07-31
Description: Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks via a crafted sales transaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2019-37; https://www.tenable.com/security/research/tra-2019-37
CVE: CVE-2019-3959
Published: 2019-07-31
Description: Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2019-37; https://www.tenable.com/security/research/tra-2019-37
CVE: CVE-2019-3960
Published: 2019-07-31
Description: Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.tenable.com/security/research/tra-2019-37; https://www.tenable.com/security/research/tra-2019-37
CVE: CVE-2019-12797
Published: 2019-07-31
Description: A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.kth.se/polopoly_fs/[PII_REDACTED]621279%21/Ludvig%20and%20Daniel_final_dongles.pdf; https://www.kth.se/polopoly_fs/[PII_REDACTED]430206%21/elm327.pdf; https://www.kth.se/polopoly_fs/[PII_REDACTED]621279%21/Ludvig%20and%20Daniel_final_dongles.pdf
CVE: CVE-2019-14456
Published: 2019-07-31
Description: Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging enabled), the text will be replayed when the logs are viewed. Exploiting this vulnerability requires access to the serial port and/or console server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://opengear.zendesk.com/hc/en-us/articles/[PII_REDACTED]91-Stored-cross-site-scripting-XSS-vulnerability-in-serial-port-logging; https://opengear.zendesk.com/hc/en-us/articles/[PII_REDACTED]91-Stored-cross-site-scripting-XSS-vulnerability-in-serial-port-logging
CVE: CVE-2019-14459
Published: 2019-07-31
Description: nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/phaag/nfdump/commit/3b006ededaf351f1723aea6c727c9edd1b1fff9b; https://github.com/phaag/nfdump/issues/171; https://lists.debian.org/debian-lts-announce/2020/09/msg00021.html
CVE: CVE-2019-10182
Published: 2019-07-31
Description: It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-94, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html; http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182
CVE: CVE-2019-10186
Published: 2019-07-31
Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/109175; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186; https://moodle.org/mod/forum/discuss.php?d=388567#p1566329
CVE: CVE-2019-10187
Published: 2019-07-31
Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: http://www.securityfocus.com/bid/109174; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187; https://moodle.org/mod/forum/discuss.php?d=388568#p1566330
CVE: CVE-2019-10188
Published: 2019-07-31
Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/109178; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10188; https://moodle.org/mod/forum/discuss.php?d=388569
CVE: CVE-2019-10189
Published: 2019-07-31
Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/109271; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10189; https://moodle.org/mod/forum/discuss.php?d=388570
CVE: CVE-2019-10198
Published: 2019-07-31
Description: An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-592, CWE-306
References: https://access.redhat.com/errata/RHSA-2019:3172; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10198; https://projects.theforeman.org/issues/27275
CVE: CVE-2019-7000
Published: 2019-07-31
Description: A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://downloads.avaya.com/css/P8/documents/101060208; https://downloads.avaya.com/css/P8/documents/101060208
CVE: CVE-2015-5297
Published: 2019-07-31
Description: An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugs.freedesktop.org/show_bug.cgi?id=92027; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5297; https://bugs.freedesktop.org/show_bug.cgi?id=92027
CVE: CVE-2019-10181
Published: 2019-07-31
Description: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345, CWE-345
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html; http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181
CVE: CVE-2019-10185
Published: 2019-07-31
Description: It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html; http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185
CVE: CVE-2019-14462
Published: 2019-07-31
Description: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc; https://libmodbus.org/2019/stable-and-development-releases/; https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html
CVE: CVE-2019-14463
Published: 2019-07-31
Description: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc; https://libmodbus.org/2019/stable-and-development-releases/; https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html
CVE: CVE-2019-14464
Published: 2019-07-31
Description: XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/milkytracker/MilkyTracker/issues/184; https://lists.debian.org/debian-lts-announce/2019/10/msg00029.html; https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html
CVE: CVE-2019-14465
Published: 2019-07-31
Description: fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/schismtracker/schismtracker/issues/198; https://github.com/schismtracker/schismtracker/releases/tag/20190805; https://security.gentoo.org/glsa/202107-12
CVE: CVE-2018-20873
Published: 2019-08-01
Description: cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20874
Published: 2019-08-01
Description: cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20875
Published: 2019-08-01
Description: cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20876
Published: 2019-08-01
Description: cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20877
Published: 2019-08-01
Description: cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20878
Published: 2019-08-01
Description: cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20879
Published: 2019-08-01
Description: cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20880
Published: 2019-08-01
Description: cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).
CVSS Score: 3.3 (LOW)
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log