| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5448 | Hig | 0.53 | 8.1 | 0.01 | Jul 30, 2019 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network. | ||
| CVE-2019-13026 | Cri | 0.64 | 9.8 | 0.01 | Jul 30, 2019 | OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary. | ||
| CVE-2019-14383 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. | ||
| CVE-2019-14382 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. | ||
| CVE-2019-14380 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files. | ||
| CVE-2018-20871 | Cri | 0.64 | 9.8 | 0.02 | Jul 30, 2019 | In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in certain cases (GE-6890). | ||
| CVE-2018-20861 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files. | ||
| CVE-2018-20860 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | libopenmpt before 0.3.13 allows a crash with malformed MED files. | ||
| CVE-2018-20859 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem. | ||
| CVE-2017-18381 | Hig | 0.47 | 7.2 | 0.01 | Jul 30, 2019 | The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials. | ||
| CVE-2019-14313 | Cri | 0.64 | 9.8 | 0.04 | Jul 30, 2019 | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php. | ||
| CVE-2019-14242 | Med | 0.44 | 6.7 | 0.01 | Jul 30, 2019 | An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bitdefender Internet Security, and Bitdefender Total Security versions prior to 23.0.24.120) that can lead to local code… | ||
| CVE-2019-1552 | Low | 0.22 | 3.3 | 0.01 | Jul 30, 2019 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options.… | ||
| CVE-2019-14318 | Med | 0.39 | 5.9 | 0.03 | Jul 30, 2019 | Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar… | ||
| CVE-2019-11202 | Cri | 0.64 | 9.8 | 0.02 | Jul 30, 2019 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher… | ||
| CVE-2019-10142 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2019 | A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw… | ||
| CVE-2019-10141 | Hig | 0.47 | 8.3 | 0.02 | Jul 30, 2019 | A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a… | ||
| CVE-2019-10138 | Hig | 0.57 | 8.8 | 0.01 | Jul 30, 2019 | A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens. | ||
| CVE-2019-10130 | Med | 0.28 | 4.3 | 0.01 | Jul 30, 2019 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common… | ||
| CVE-2019-10129 | Med | 0.42 | 6.5 | 0.02 | Jul 30, 2019 | A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack.… | ||
| CVE-2018-16871 | Hig | 0.49 | 7.5 | 0.03 | Jul 30, 2019 | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine… | ||
| CVE-2019-14414 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). | ||
| CVE-2019-14413 | Med | 0.28 | 4.3 | 0.01 | Jul 30, 2019 | cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). | ||
| CVE-2019-14412 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). | ||
| CVE-2019-14411 | Med | 0.35 | 5.3 | 0.01 | Jul 30, 2019 | cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). | ||
| CVE-2019-14410 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). | ||
| CVE-2019-14409 | Med | 0.36 | 5.5 | 0.00 | Jul 30, 2019 | cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). | ||
| CVE-2019-14408 | Med | 0.28 | 4.3 | 0.01 | Jul 30, 2019 | cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). | ||
| CVE-2019-14407 | Low | 0.18 | 2.7 | 0.01 | Jul 30, 2019 | cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). | ||
| CVE-2019-14406 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). | ||
| CVE-2019-14405 | Hig | 0.57 | 8.8 | 0.01 | Jul 30, 2019 | cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). | ||
| CVE-2019-14404 | Med | 0.36 | 5.5 | 0.00 | Jul 30, 2019 | cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). | ||
| CVE-2019-14403 | Med | 0.28 | 4.3 | 0.01 | Jul 30, 2019 | cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). | ||
| CVE-2019-14402 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). | ||
| CVE-2019-14401 | Hig | 0.57 | 8.8 | 0.01 | Jul 30, 2019 | cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). | ||
| CVE-2019-14400 | Hig | 0.51 | 7.8 | 0.00 | Jul 30, 2019 | cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). | ||
| CVE-2019-14399 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2019 | The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). | ||
| CVE-2019-14398 | Hig | 0.57 | 8.8 | 0.01 | Jul 30, 2019 | cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). | ||
| CVE-2019-14397 | Med | 0.35 | 5.3 | 0.01 | Jul 30, 2019 | cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). | ||
| CVE-2019-14396 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). | ||
| CVE-2019-14395 | Low | 0.21 | 3.3 | 0.00 | Jul 30, 2019 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). | ||
| CVE-2019-14394 | Med | 0.36 | 5.5 | 0.00 | Jul 30, 2019 | cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). | ||
| CVE-2019-14393 | Med | 0.34 | 5.3 | 0.00 | Jul 30, 2019 | cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486). | ||
| CVE-2018-20870 | Med | 0.36 | 5.5 | 0.00 | Jul 30, 2019 | The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). | ||
| CVE-2018-20869 | Hig | 0.51 | 7.8 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). | ||
| CVE-2018-20868 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). | ||
| CVE-2018-20866 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). | ||
| CVE-2018-20865 | Med | 0.40 | 6.1 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). | ||
| CVE-2018-20864 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). | ||
| CVE-2018-20863 | Cri | 0.64 | 9.8 | 0.02 | Jul 30, 2019 | cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). |
- risk 0.53cvss 8.1epss 0.01
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
- risk 0.64cvss 9.8epss 0.01
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
- risk 0.42cvss 6.5epss 0.01
J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- risk 0.42cvss 6.5epss 0.01
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- risk 0.42cvss 6.5epss 0.01
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
- risk 0.64cvss 9.8epss 0.02
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in certain cases (GE-6890).
- risk 0.42cvss 6.5epss 0.01
libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
- risk 0.42cvss 6.5epss 0.01
libopenmpt before 0.3.13 allows a crash with malformed MED files.
- risk 0.40cvss 6.1epss 0.01
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
- risk 0.47cvss 7.2epss 0.01
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
- risk 0.64cvss 9.8epss 0.04
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
- risk 0.44cvss 6.7epss 0.01
An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bitdefender Internet Security, and Bitdefender Total Security versions prior to 23.0.24.120) that can lead to local code…
- risk 0.22cvss 3.3epss 0.01
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options.…
- risk 0.39cvss 5.9epss 0.03
Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar…
- risk 0.64cvss 9.8epss 0.02
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher…
- risk 0.46cvss 7.1epss 0.00
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw…
- risk 0.47cvss 8.3epss 0.02
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a…
- risk 0.57cvss 8.8epss 0.01
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- risk 0.28cvss 4.3epss 0.01
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common…
- risk 0.42cvss 6.5epss 0.02
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack.…
- risk 0.49cvss 7.5epss 0.03
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine…
- risk 0.21cvss 3.3epss 0.00
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
- risk 0.28cvss 4.3epss 0.01
cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
- risk 0.21cvss 3.3epss 0.00
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
- risk 0.35cvss 5.3epss 0.01
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
- risk 0.21cvss 3.3epss 0.00
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
- risk 0.36cvss 5.5epss 0.00
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
- risk 0.28cvss 4.3epss 0.01
cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
- risk 0.18cvss 2.7epss 0.01
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
- risk 0.40cvss 6.1epss 0.01
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
- risk 0.57cvss 8.8epss 0.01
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
- risk 0.36cvss 5.5epss 0.00
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
- risk 0.28cvss 4.3epss 0.01
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
- risk 0.21cvss 3.3epss 0.00
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
- risk 0.57cvss 8.8epss 0.01
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
- risk 0.51cvss 7.8epss 0.00
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
- risk 0.46cvss 7.1epss 0.00
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
- risk 0.57cvss 8.8epss 0.01
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
- risk 0.35cvss 5.3epss 0.01
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
- risk 0.21cvss 3.3epss 0.00
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
- risk 0.21cvss 3.3epss 0.00
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
- risk 0.36cvss 5.5epss 0.00
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
- risk 0.34cvss 5.3epss 0.00
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
- risk 0.36cvss 5.5epss 0.00
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
- risk 0.51cvss 7.8epss 0.01
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
- risk 0.40cvss 6.1epss 0.01
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
- risk 0.42cvss 6.5epss 0.01
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
- risk 0.64cvss 9.8epss 0.02
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).