2019

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a

A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excludi

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A S

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excl

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned tab

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_s

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).

cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).

cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root ac

cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).

API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).

IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XX

IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of t

IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack w

cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is

cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a writ

An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote at

In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang

An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (applica

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).

cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).

cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).