deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20881
Published: 2019-08-01
Description: cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20882
Published: 2019-08-01
Description: cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20883
Published: 2019-08-01
Description: cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20884
Published: 2019-08-01
Description: cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20885
Published: 2019-08-01
Description: cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2019-14332
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie-hellman-group1-sha1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-326
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14333
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14334
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14336
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14337
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the `/bin/sh -c wget` sequence.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14338
Published: 2019-08-01
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://us.dlink.com/en/security-advisory; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-14468
Published: 2019-08-01
Description: GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://sourceforge.net/p/open-cobol/bugs/581/; https://sourceforge.net/p/open-cobol/bugs/581/
CVE: CVE-2014-8183
Published: 2019-08-01
Description: It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8183; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8183
CVE: CVE-2015-7559
Published: 2019-08-01
Description: It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CVSS Score: 2.7 (LOW)
CWE: CWE-306, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559; https://issues.apache.org/jira/browse/AMQ-6470; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559
CVE: CVE-2018-10899
Published: 2019-08-01
Description: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-352
References: https://access.redhat.com/errata/RHSA-2019:2413; https://access.redhat.com/errata/RHSA-2019:2804; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899
CVE: CVE-2018-11892
Published: 2019-08-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-20886
Published: 2019-08-01
Description: cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20887
Published: 2019-08-01
Description: cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20888
Published: 2019-08-01
Description: cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20889
Published: 2019-08-01
Description: cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20890
Published: 2019-08-01
Description: cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20891
Published: 2019-08-01
Description: cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20892
Published: 2019-08-01
Description: cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).
CVSS Score: 4.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20893
Published: 2019-08-01
Description: cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).
CVSS Score: 2.3 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20894
Published: 2019-08-01
Description: cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/74+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/74+Change+Log
CVE: CVE-2018-20895
Published: 2019-08-01
Description: In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20896
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).
CVSS Score: 3.9 (LOW)
CWE: CWE-94
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20897
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).
CVSS Score: 2.8 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20898
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20899
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20900
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2019-0193
Published: 2019-08-01
Description: In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://issues.apache.org/jira/browse/SOLR-13669; https://lists.apache.org/thread.html/1addbb49a1fc0947fb32ca663d76d93cfaade35a4848a76d4b4ded9c%40%3Cissues.lucene.apache.org%3E; https://lists.apache.org/thread.html/42cc4d334ba33905b872a0aa00d6a481391951c8b1450f01b077ce74%40%3Cissues.lucene.apache.org%3E
CVE: CVE-2019-3884
Published: 2019-08-01
Description: A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-290, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3884; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3884
CVE: CVE-2019-3890
Published: 2019-08-01
Description: It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-296, CWE-295
References: https://access.redhat.com/errata/RHSA-2019:3699; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3890; https://gitlab.gnome.org/GNOME/evolution-ews/issues/27
CVE: CVE-2013-7473
Published: 2019-08-01
Description: Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://zeroscience.mk/blog/07/2013/windu-cms-2-2-multiple-stored-xss-and-csrf-vulnerabilities/; http://zeroscience.mk/blog/07/2013/windu-cms-2-2-multiple-stored-xss-and-csrf-vulnerabilities/
CVE: CVE-2013-7474
Published: 2019-08-01
Description: Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://zeroscience.mk/blog/07/2013/windu-cms-2-2-multiple-stored-xss-and-csrf-vulnerabilities/; http://zeroscience.mk/blog/07/2013/windu-cms-2-2-multiple-stored-xss-and-csrf-vulnerabilities/
CVE: CVE-2015-9291
Published: 2019-08-01
Description: cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/11.52+Change+Log; https://documentation.cpanel.net/display/CL/11.52+Change+Log
CVE: CVE-2016-10850
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10851
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10852
Published: 2019-08-01
Description: cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10853
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10854
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10855
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10856
Published: 2019-08-01
Description: cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10857
Published: 2019-08-01
Description: cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2015-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10858
Published: 2019-08-01
Description: cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://forums.cpanel.net/threads/cpanel-tsr-2015-0006-full-disclosure.510181/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10859
Published: 2019-08-01
Description: cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2015-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10860
Published: 2019-08-01
Description: cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2018-20901
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20902
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20903
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20904
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20905
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20906
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20907
Published: 2019-08-01
Description: cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20908
Published: 2019-08-01
Description: cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/72+Change+Log; https://documentation.cpanel.net/display/CL/72+Change+Log
CVE: CVE-2018-20909
Published: 2019-08-01
Description: cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20910
Published: 2019-08-01
Description: cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20911
Published: 2019-08-01
Description: cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20912
Published: 2019-08-01
Description: cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20913
Published: 2019-08-01
Description: cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20914
Published: 2019-08-01
Description: In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).
CVSS Score: 7.3 (HIGH)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20915
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log