2019

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned tab

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_s

cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of t

cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a writ

An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote at

In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang

An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (applica

cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).

cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).

A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the

Planon before Live Build 41 has XSS.

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vul

Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a s

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view de

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_p

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Ne

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of

The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online ser

edx-platform before 2015-09-17 allows XSS via a team name.

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

stacktable.js before 1.0.4 allows XSS.

Dependency-Track before 3.5.1 allows XSS.

invenio-app before 1.1.1 allows host header injection.

invenio-communities before 1.0.0a20 allows XSS.

invenio-records before 1.2.2 allows XSS.

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email mess

invenio-previewer before 1.0.0a12 allows XSS.

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.

ASH-AIO before 2.0.0.3 allows an open redirect.

docker-credential-helpers before 0.6.3 has a double free in the List functions.

parse-server before 3.6.0 allows account enumeration.

Misskey before 10.102.4 allows hijacking a user's token.

In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.