deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20916
Published: 2019-08-01
Description: cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20917
Published: 2019-08-01
Description: cPanel before 70.0.23 allows any user to disable Solr (SEC-371).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20918
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20919
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20920
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20921
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20922
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20923
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2019-13572
Published: 2019-08-01
Description: The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-094; https://plugins.trac.wordpress.org/changeset/2126559/blog2social/trunk/includes/Ajax/Get.php; https://wpvulndb.com/vulnerabilities/9476
CVE: CVE-2019-14259
Published: 2019-08-01
Description: On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Obihai_Obi1002.pdf?_=[PII_REDACTED]; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Obihai_Obi1002.pdf?_=[PII_REDACTED]
CVE: CVE-2019-14471
Published: 2019-08-01
Description: TestLink 1.9.19 has XSS via the error.php message parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://code610.blogspot.com/2019/07/xss-in-testlink-1919.html; https://code610.blogspot.com/2019/07/xss-in-testlink-1919.html
CVE: CVE-2019-14472
Published: 2019-08-01
Description: Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://code610.blogspot.com/2019/07/xss-in-zurmo-crm.html; https://code610.blogspot.com/2019/07/xss-in-zurmo-crm.html
CVE: CVE-2016-10836
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10837
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
CVSS Score: 7.5 (HIGH)
CWE: CWE-426
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10838
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10839
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10840
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10841
Published: 2019-08-01
Description: The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-199
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10842
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10843
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10844
Published: 2019-08-01
Description: The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10845
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10846
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
CVSS Score: 8.1 (HIGH)
CWE: CWE-275
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10847
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10848
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
CVSS Score: 7.2 (HIGH)
CWE: CWE-285
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2016-10849
Published: 2019-08-01
Description: cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://documentation.cpanel.net/display/CL/54+Change+Log; https://documentation.cpanel.net/display/CL/54+Change+Log
CVE: CVE-2018-20924
Published: 2019-08-01
Description: cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20925
Published: 2019-08-01
Description: cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-434
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20926
Published: 2019-08-01
Description: cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-434
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20927
Published: 2019-08-01
Description: cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).
CVSS Score: 3.8 (LOW)
CWE: CWE-285
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20928
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20929
Published: 2019-08-01
Description: cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20930
Published: 2019-08-01
Description: cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20931
Published: 2019-08-01
Description: cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20932
Published: 2019-08-01
Description: cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
CVSS Score: 2.7 (LOW)
CWE: CWE-538
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20933
Published: 2019-08-01
Description: cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20934
Published: 2019-08-01
Description: cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-358
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2018-20935
Published: 2019-08-01
Description: cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/70+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/70+Change+Log
CVE: CVE-2019-14486
Published: 2019-08-01
Description: GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://sourceforge.net/p/open-cobol/bugs/582/; https://sourceforge.net/p/open-cobol/bugs/582/
CVE: CVE-2016-10822
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10823
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10824
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10825
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
CVSS Score: 8.1 (HIGH)
CWE: CWE-358
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10827
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10828
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10829
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10830
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10831
Published: 2019-08-01
Description: cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10832
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10833
Published: 2019-08-01
Description: cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10834
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
CVSS Score: 8.8 (HIGH)
CWE: CWE-358
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2016-10835
Published: 2019-08-01
Description: cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/56+Change+Log; https://documentation.cpanel.net/display/CL/56+Change+Log
CVE: CVE-2018-20936
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20937
Published: 2019-08-01
Description: cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20938
Published: 2019-08-01
Description: cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20939
Published: 2019-08-01
Description: cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20940
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
CVSS Score: 3.3 (LOW)
CWE: CWE-362
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20941
Published: 2019-08-01
Description: cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20942
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20943
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20944
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20945
Published: 2019-08-01
Description: bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-285
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20946
Published: 2019-08-01
Description: cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20947
Published: 2019-08-01
Description: cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20948
Published: 2019-08-01
Description: cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20949
Published: 2019-08-01
Description: cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20950
Published: 2019-08-01
Description: cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20951
Published: 2019-08-01
Description: cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://news.cpanel.com/cpanel-tsr-2018-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20952
Published: 2019-08-01
Description: cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2018-20953
Published: 2019-08-01
Description: cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/68+Change+Log; https://documentation.cpanel.net/display/CL/68+Change+Log
CVE: CVE-2019-14491
Published: 2019-08-01
Description: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html; https://github.com/opencv/opencv/compare/33b765d...4a7ca5a; https://github.com/opencv/opencv/compare/371bba8...ddbd10c