CVEs published August 1, 2019
162 CVEs were published on August 1, 2019: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 162
- Critical
- 0
- High
- 5
- Medium
- 1
- Low
- 2
- Unrated
- 154
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- Apache ActiveMQ · org.apache.activemq:activemq-client
- 1
- Apache Solr · org.apache.solr:solr-core
- 1
- editor.md
- 1
- HP 2910-48G al Switch
- 1
- jolokia · org.jolokia:jolokia-core
- 1
- opencv-contrib-python-headless · opencv-contrib-python +2
- 1
- opencv-contrib-python-headless · opencv-python +2
- 1
- opencv-python-headless · opencv-python +2
- 1
- Red Hat atomic-openshift
- 1
- SPC CLOUD Happypoint mobile app
- 1
High 5
- CVE-2019-9140Happypoint mobile application information disclosure vulnerabilitySPC CLOUD Happypoint mobile app
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiApache Solr · org.apache.solr:solr-core
- CVE-2014-8183It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources.theforeman foreman
- CVE-2018-10899A flaw was found in Jolokia versions from 1.2 to before 1.6.1.jolokia · org.jolokia:jolokia-core
- CVE-2019-3890It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates.The Gnome Project evolution-ews
Medium, low and unrated 157
- CVE-2019-14517pandao Editor.md 1.5.0 allows XSS via the Javascript: string.editor.md
- CVE-2019-5401A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016.HP 2910-48G al Switch
- CVE-2019-14513Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read ope
- CVE-2019-14260On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input val
- CVE-2016-10813cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
- CVE-2016-10814cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
- CVE-2016-10815cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
- CVE-2016-10816cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
- CVE-2016-10817cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
- CVE-2016-10818cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
- CVE-2016-10819In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
- CVE-2016-10820cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
- CVE-2016-10821In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
- CVE-2016-10826cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
- CVE-2019-14497ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- CVE-2019-14496LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- CVE-2019-14495webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.
- CVE-2016-10822cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
- CVE-2016-10823cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).
- CVE-2016-10824cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
- CVE-2016-10825cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
- CVE-2016-10827cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
- CVE-2016-10828cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
- CVE-2016-10829cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
- CVE-2016-10830cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
- CVE-2016-10831cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
- CVE-2018-20953cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).
- CVE-2018-20952cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).
- CVE-2018-20951cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).
- CVE-2018-20950cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).
- CVE-2018-20949cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
- CVE-2018-20948cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
- CVE-2018-20947cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).
- CVE-2018-20946cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script
- CVE-2018-20945bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).
- CVE-2018-20944cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).
- CVE-2016-10832cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
- CVE-2018-20943cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).
- CVE-2018-20942cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).
- CVE-2018-20941cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).
- CVE-2016-10833cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
- CVE-2018-20940cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
- CVE-2018-20939cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).
- CVE-2018-20938cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
- CVE-2016-10834cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
- CVE-2018-20937cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).
- CVE-2016-10835cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
- CVE-2018-20936cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).
- CVE-2019-14494An issue was discovered in Poppler through 0.78.0.
- CVE-2019-14493An issue was discovered in OpenCV before 4.1.1.opencv-contrib-python-headless · opencv-python +2
- CVE-2019-14492An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1.opencv-contrib-python-headless · opencv-contrib-python +2
- CVE-2019-14491An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1.opencv-python-headless · opencv-python +2
- CVE-2016-10836cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
- CVE-2018-20935cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
- CVE-2018-20934cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
- CVE-2018-20933cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).
- CVE-2018-20932cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
- CVE-2018-20931cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).
- CVE-2018-20930cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).
- CVE-2016-10837cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
- CVE-2016-10838cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
- CVE-2018-20928cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).
- CVE-2016-10839cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
- CVE-2016-10840cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
- CVE-2016-10841The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
- CVE-2016-10842cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
- CVE-2016-10843cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
- CVE-2016-10844The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
- CVE-2016-10845cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
- CVE-2016-10846cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
- CVE-2016-10847cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
- CVE-2016-10848cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
- CVE-2016-10849cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
- CVE-2019-14486GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.
- CVE-2018-20929cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392).
- CVE-2018-20927cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).
- CVE-2018-20926cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380).
- CVE-2018-20925cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379).
- CVE-2018-20924cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378).
- CVE-2016-10850cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
- CVE-2018-20923cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).
- CVE-2018-20922cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).
- CVE-2018-20921cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).
- CVE-2018-20920cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).
- CVE-2018-20919cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).
- CVE-2016-10851cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
- CVE-2018-20918cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).
- CVE-2016-10852cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
- CVE-2018-20917cPanel before 70.0.23 allows any user to disable Solr (SEC-371).
- CVE-2018-20916cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).
- CVE-2018-20915cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).
- CVE-2016-10853cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
- CVE-2018-20914In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).
- CVE-2019-14259On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP add
- CVE-2016-10854cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
- CVE-2018-20913cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).
- CVE-2018-20912cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).
- CVE-2016-10855cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
- CVE-2018-20911cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).
- CVE-2016-10856cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
- CVE-2016-10857cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
- CVE-2016-10858cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
- CVE-2016-10859cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
- CVE-2019-13572The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
- CVE-2016-10860cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
- CVE-2015-9291cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
- CVE-2018-20910cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).
- CVE-2018-20909cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).
- CVE-2018-20908cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).
- CVE-2018-20907cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).
- CVE-2018-20906cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).
- CVE-2018-20905cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).
- CVE-2018-20904cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).
- CVE-2018-20903cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
- CVE-2013-7473Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.
- CVE-2018-20902cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
- CVE-2018-20901cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).
- CVE-2013-7474Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users.
- CVE-2019-14472Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
- CVE-2019-14471TestLink 1.9.19 has XSS via the error.php message parameter.
- CVE-2018-20900cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).
- CVE-2018-20899cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).
- CVE-2018-20898cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).
- CVE-2018-20897cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).
- CVE-2018-20896cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).
- CVE-2018-20895In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).
- CVE-2019-3884A vulnerability exists in the garbage collection mechanism of atomic-openshift.Red Hat atomic-openshift
- CVE-2018-20894cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).
- CVE-2018-20893cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).
- CVE-2018-20892cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).
- CVE-2018-20891cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).
- CVE-2018-20890cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).
- CVE-2018-20889cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).
- CVE-2018-20888cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424).
- CVE-2018-20887cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).
- CVE-2018-20886cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).
- CVE-2018-20885cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).
- CVE-2018-20884cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).
- CVE-2019-14468GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.
- CVE-2018-20883cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).
- CVE-2018-20882cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).
- CVE-2018-20881cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).
- CVE-2018-20880cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).
- CVE-2018-20879cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).
- CVE-2018-20878cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).
- CVE-2018-20877cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).
- CVE-2018-20876cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).
- CVE-2018-20875cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).
- CVE-2018-20874cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).
- CVE-2018-20873cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).
- CVE-2019-14338An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2019-14337An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2019-14336An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2019-14334An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2019-14333An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2019-14332An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices.
- CVE-2015-7559It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class.Apache ActiveMQ · org.apache.activemq:activemq-client