deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18411
Published: 2019-08-02
Description: The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18412
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
CVSS Score: 2.5 (LOW)
CWE: CWE-532
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18413
Published: 2019-08-02
Description: In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18414
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18415
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2017-18416
Published: 2019-08-02
Description: cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-1987
Published: 2019-08-02
Description: IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=ibm10883782; https://exchange.xforce.ibmcloud.com/vulnerabilities/154280; http://www.ibm.com/support/docview.wss?uid=ibm10883782
CVE: CVE-2019-10171
Published: 2019-08-02
Description: It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171
CVE: CVE-2019-10938
Published: 2019-08-02
Description: A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions < V8.01), Siemens Power Meters Series 9410 (All versions < V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf
CVE: CVE-2019-14528
Published: 2019-08-02
Description: GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/open-cobol/bugs/583/; https://sourceforge.net/p/open-cobol/bugs/583/
CVE: CVE-2019-14529
Published: 2019-08-02
Description: OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Wezery/CVE-2019-14529; https://github.com/openemr/openemr/pull/2592; https://github.com/Wezery/CVE-2019-14529
CVE: CVE-2019-4275
Published: 2019-08-02
Description: IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could cause a denial of service. IBM X-Force ID: 160296.
CVSS Score: 5.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10959011; https://exchange.xforce.ibmcloud.com/vulnerabilities/160296; http://www.ibm.com/support/docview.wss?uid=ibm10959011
CVE: CVE-2019-10176
Published: 2019-08-02
Description: A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://access.redhat.com/errata/RHSA-2019:2792; https://access.redhat.com/errata/RHSA-2019:4053; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10176
CVE: CVE-2019-14232
Published: 2019-08-02
Description: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html; http://www.openwall.com/lists/oss-security/2023/10/04/6
CVE: CVE-2019-14233
Published: 2019-08-02
Description: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html; https://docs.djangoproject.com/en/dev/releases/security/
CVE: CVE-2019-14235
Published: 2019-08-02
Description: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html; https://docs.djangoproject.com/en/dev/releases/security/
CVE: CVE-2019-14531
Published: 2019-08-02
Description: An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/sleuthkit/sleuthkit/issues/1576; https://github.com/sleuthkit/sleuthkit/issues/1576
CVE: CVE-2019-14532
Published: 2019-08-02
Description: An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://github.com/sleuthkit/sleuthkit/issues/1575; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EY53OYU7UZLAJWNIVVNR3EX2RNCCFTB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQR2QY3IAF2IG6HGBSKGL66VUDOTC3OA/
CVE: CVE-2019-5493
Published: 2019-08-02
Description: Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple non-default options be enabled.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-5501
Published: 2019-08-02
Description: Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-18417
Published: 2019-08-02
Description: cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18418
Published: 2019-08-02
Description: cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18419
Published: 2019-08-02
Description: cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18420
Published: 2019-08-02
Description: cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18421
Published: 2019-08-02
Description: cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18422
Published: 2019-08-02
Description: In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18423
Published: 2019-08-02
Description: In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18424
Published: 2019-08-02
Description: In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18425
Published: 2019-08-02
Description: In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
CVSS Score: 2.5 (LOW)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18426
Published: 2019-08-02
Description: cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
CVSS Score: 2.7 (LOW)
CWE: CWE-532
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18427
Published: 2019-08-02
Description: In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18428
Published: 2019-08-02
Description: In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18429
Published: 2019-08-02
Description: In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
CVSS Score: 3.3 (LOW)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18430
Published: 2019-08-02
Description: In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0004-full-disclosure/; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18431
Published: 2019-08-02
Description: cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/66+Change+Log; https://documentation.cpanel.net/display/CL/66+Change+Log
CVE: CVE-2017-18432
Published: 2019-08-02
Description: In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18433
Published: 2019-08-02
Description: cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18434
Published: 2019-08-02
Description: cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18435
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2019-9141
Published: 2019-08-02
Description: ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35104; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35104
CVE: CVE-2017-18436
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18437
Published: 2019-08-02
Description: cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18438
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18439
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18440
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18441
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18442
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18443
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18444
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18445
Published: 2019-08-02
Description: cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18446
Published: 2019-08-02
Description: cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18447
Published: 2019-08-02
Description: cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18448
Published: 2019-08-02
Description: cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18449
Published: 2019-08-02
Description: cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18450
Published: 2019-08-02
Description: cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18451
Published: 2019-08-02
Description: cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18452
Published: 2019-08-02
Description: cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18453
Published: 2019-08-02
Description: cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/64+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/64+Change+Log
CVE: CVE-2017-18454
Published: 2019-08-02
Description: cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0003-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18455
Published: 2019-08-02
Description: In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
CVSS Score: 2.7 (LOW)
CWE: CWE-264
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log