Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,571 results · page 186 of 392
Sep 11, 2019drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.CVE-2019-16230 · Computers, phones & browsers · Linux · reported by MITREMedium 4.7
drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: A third-party software maintainer states that the work queue allocation is happening during device initialization, which for a graphics card occurs during boot. It is not attacker controllable and OOM at that time is highly unlikely
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comlkml.org
Sep 11, 2019drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.CVE-2019-16229 · Computers, phones & browsers · Linux · reported by MITREMedium 4.1
drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comlkml.org
Sep 10, 2019In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earCVE-2019-11466 · Other software · Couchbase · reported by MITREMedium 5.3
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.
- Product
- Couchbase Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcouchbase.comcouchbase.com
Sep 10, 2019SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controllCVE-2019-0361 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 9, 2019Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.CVE-2019-16179 · Other software · Limesurvey · reported by MITREMedium 5.3
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlimesurvey.org
Sep 8, 2019IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.CVE-2016-10937 · Other software · Imapfilter Project · reported by MITREHigh 7.5
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Product
- Imapfilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Sep 5, 2019The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data dCVE-2019-14339 · Other software · Canon · reported by MITREMedium 5.5
The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.complay.google.com
Sep 5, 2019In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token.CVE-2019-13190 · Other software · ENG · reported by MITREMedium 5.3
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.contentsecurity.com.aublog.contentsecurity.com.au
Sep 4, 2019The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon fCVE-2019-12588 · Other software · Espressif · reported by MITREMedium 6.5
The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
- Product
- Arduino Esp8266
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2019The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly.CVE-2019-14437 · Other software · Videolan · reported by MITREHigh 7.8
The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.
- Product
- VLC Media Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orglists.opensuse.org
Aug 28, 2019WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions weCVE-2019-15716 · Other software · Wtfutil · reported by MITREMedium 5.5
WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.
- Product
- WTF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2019cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations.CVE-2019-15714 · Other software · Entropic Project · reported by MITREMedium 5.3
cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations.
- Product
- Entropic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2019In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, becauseCVE-2019-15702 · Other software · Riot-os · reported by MITREHigh 7.5
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option.
- Product
- Riot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2019public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed valCVE-2019-15700 · Other software · Frappe · reported by MITREMedium 6.1
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.CVE-2019-15640 · Other software · Limesurvey · reported by MITREHigh 7.5
Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2019filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that cCVE-2019-15540 · Other software · Cdemu · reported by MITREHigh 7.8
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
- Product
- Libmirage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 20, 2019IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actorCVE-2019-4338 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.
- Product
- Security Guardium Big Data Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 18, 2019The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policyCVE-2019-15136 · Other software · Eprosima · reported by MITREHigh 7.5
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
- Product
- Fast-rtps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2019do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.CVE-2018-20969 · Other software · GNU · reported by MITREHigh 7.8
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.
- Product
- Patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comaccess.redhat.com
Aug 15, 2019xtrlock through 2.10 does not block multitouch events.CVE-2016-10894 · Other software · Xtrlock Project · reported by MITREMedium 4.6
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
- Product
- Xtrlock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.debian.org
Aug 14, 2019A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected ShaCVE-2019-1203 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 14, 2019The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencCVE-2019-9506 · Other software · Bluetooth · reported by cret@cert.orgHigh 8.1
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.
- Product
- BR/EDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 14, 2019The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set.CVE-2019-0341 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Aug 14, 2019Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and alCVE-2019-0337 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
- Product
- SAP NetWeaver Process Integration (Java Proxy Runtime)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Aug 14, 2019Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.CVE-2019-14975 · Other software · Artifex · reported by MITREHigh 7.1
Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.
- Product
- Mupdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.ghostscript.combugs.ghostscript.com
Aug 8, 2019The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.CVE-2018-20954 · Other software · Mailpile · reported by MITREHigh 7.5
The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
- Product
- Mailpile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2019Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators.CVE-2019-14769 · Other software · Backdropcms · reported by MITREMedium 6.1
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is typically an administrative permission.)
- Product
- Backdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackdropcms.orgbackdropcms.org
Aug 7, 2019cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).CVE-2016-10799 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 6, 2019NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restriCVE-2019-5682 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the Activity, which may lead to code execution or denial of service.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Aug 6, 2019cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).CVE-2016-10791 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).CVE-2016-10790 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).CVE-2017-18480 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 5, 2019Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).CVE-2017-18476 · Websites & servers · Cpanel · reported by MITREHigh 7.5
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).CVE-2016-10772 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).CVE-2017-18466 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).CVE-2017-18465 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 2, 2019cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).CVE-2017-18461 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).CVE-2017-18453 · Websites & servers · Cpanel · reported by MITREMedium 4.9
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).CVE-2017-18445 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).CVE-2017-18431 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 2, 2019cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).CVE-2017-18407 · Websites & servers · Cpanel · reported by MITREMedium 4.8
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).CVE-2017-18397 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of ssl (SEC-328).CVE-2017-18395 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).CVE-2017-18394 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).CVE-2017-18393 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).CVE-2017-18388 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly.CVE-2019-9140 · Other software · SPC CLOUD · reported by vuln@krcert.or.krHigh 8.1
When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.
- Product
- Happypoint mobile app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2019cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).CVE-2018-20938 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).CVE-2018-20937 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).CVE-2016-10831 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.