2019

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-12

Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to

Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse t

A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a val

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-39

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authenticatio

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. T

It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection c

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on cert

GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape t

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dum

An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-auth

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated de

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers fo

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (S

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).