deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14492
Published: 2019-08-01
Description: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html; https://github.com/opencv/opencv/compare/33b765d...4a7ca5a; https://github.com/opencv/opencv/compare/371bba8...ddbd10c
CVE: CVE-2019-14493
Published: 2019-08-01
Description: An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/opencv/opencv/compare/371bba8...ddbd10c; https://github.com/opencv/opencv/issues/15127; https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE: CVE-2019-14494
Published: 2019-08-01
Description: An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://gitlab.freedesktop.org/poppler/poppler/issues/802; https://gitlab.freedesktop.org/poppler/poppler/merge_requests/317; https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html
CVE: CVE-2019-14495
Published: 2019-08-01
Description: webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/z3APA3A/3proxy/commit/3b67dc844789dc0f00e934270c7b349bcb547865; https://github.com/z3APA3A/3proxy/compare/0.8.12...0.8.13; https://github.com/z3APA3A/3proxy/releases/tag/0.8.13
CVE: CVE-2019-9140
Published: 2019-08-01
Description: When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-601
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103
CVE: CVE-2019-14496
Published: 2019-08-01
Description: LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/milkytracker/MilkyTracker/issues/183; https://lists.debian.org/debian-lts-announce/2019/10/msg00029.html; https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html
CVE: CVE-2019-14497
Published: 2019-08-01
Description: ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/milkytracker/MilkyTracker/issues/182; https://lists.debian.org/debian-lts-announce/2019/10/msg00029.html; https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html
CVE: CVE-2016-10813
Published: 2019-08-01
Description: cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10814
Published: 2019-08-01
Description: cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10815
Published: 2019-08-01
Description: cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10816
Published: 2019-08-01
Description: cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10817
Published: 2019-08-01
Description: cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10818
Published: 2019-08-01
Description: cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10819
Published: 2019-08-01
Description: In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://documentation.cpanel.net/display/CL/58+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/58+Change+Log
CVE: CVE-2016-10820
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2016-0002-full-disclosure.534481/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10821
Published: 2019-08-01
Description: In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10826
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2019-14260
Published: 2019-08-01
Description: On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Alcatel_8008CloudEditionDeskPhone.pdf?_=[PII_REDACTED]; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Alcatel_8008CloudEditionDeskPhone.pdf?_=[PII_REDACTED]
CVE: CVE-2019-14513
Published: 2019-08-01
Description: Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/Slovejoy/dnsmasq-pre2.76; https://lists.debian.org/debian-lts-announce/2019/09/msg00013.html; https://github.com/Slovejoy/dnsmasq-pre2.76
CVE: CVE-2019-5401
Published: 2019-08-01
Description: A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields (management URL, location, contact). But admin privileges are required to configure these fields thereby reducing the likelihood of exploit. HPE Aruba has provided firmware updates to resolve the vulnerability in HP 2910-48G al Switch. Please update to W.15.14.0017.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03944en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03944en_us
CVE: CVE-2019-14517
Published: 2019-08-01
Description: pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pandao/editor.md/issues/709; https://github.com/pandao/editor.md/issues/709
CVE: CVE-2019-14523
Published: 2019-08-02
Description: An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00083.html; https://github.com/schismtracker/schismtracker/issues/202
CVE: CVE-2019-14524
Published: 2019-08-02
Description: An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00083.html; https://github.com/schismtracker/schismtracker/issues/201
CVE: CVE-2014-8184
Published: 2019-08-02
Description: A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8184; https://github.com/liblouis/liblouis/issues/425; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8184
CVE: CVE-2017-18382
Published: 2019-08-02
Description: cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18383
Published: 2019-08-02
Description: cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18384
Published: 2019-08-02
Description: cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
CVSS Score: 3.8 (LOW)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18385
Published: 2019-08-02
Description: cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18386
Published: 2019-08-02
Description: cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18387
Published: 2019-08-02
Description: cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18388
Published: 2019-08-02
Description: cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18389
Published: 2019-08-02
Description: cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18390
Published: 2019-08-02
Description: cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
CVSS Score: 7.8 (HIGH)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18391
Published: 2019-08-02
Description: cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2017-0006-full-disclosure.615839/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2019-10166
Published: 2019-08-02
Description: It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/libvirt-privesc-vulnerabilities; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10166; https://security.gentoo.org/glsa/202003-18
CVE: CVE-2019-10167
Published: 2019-08-02
Description: The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-284, CWE-22, CWE-862
References: https://access.redhat.com/libvirt-privesc-vulnerabilities; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167; https://security.gentoo.org/glsa/202003-18
CVE: CVE-2019-10168
Published: 2019-08-02
Description: The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-284, CWE-22
References: https://access.redhat.com/libvirt-privesc-vulnerabilities; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10168; https://security.gentoo.org/glsa/202003-18
CVE: CVE-2017-18392
Published: 2019-08-02
Description: cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).
CVSS Score: 2.0 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18393
Published: 2019-08-02
Description: cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18394
Published: 2019-08-02
Description: cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18395
Published: 2019-08-02
Description: cPanel before 68.0.15 does not block a username of ssl (SEC-328).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18396
Published: 2019-08-02
Description: cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18397
Published: 2019-08-02
Description: cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18398
Published: 2019-08-02
Description: DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
CVSS Score: 3.8 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18399
Published: 2019-08-02
Description: cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18400
Published: 2019-08-02
Description: cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18401
Published: 2019-08-02
Description: cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18402
Published: 2019-08-02
Description: cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18403
Published: 2019-08-02
Description: cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18404
Published: 2019-08-02
Description: cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18405
Published: 2019-08-02
Description: cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18406
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18407
Published: 2019-08-02
Description: cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-347
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18408
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18409
Published: 2019-08-02
Description: In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18410
Published: 2019-08-02
Description: In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log