# CVEs published 2019-08-01

162 CVEs were published on August 1, 2019: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-14517](https://cve.now/CVE-2019-14517.md): pandao Editor.md 1.5.0 allows XSS via the Javascript: string. (no CVSS, editor.md)
- [CVE-2019-5401](https://cve.now/CVE-2019-5401.md): A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. (no CVSS, HP 2910-48G al Switch)
- [CVE-2019-14513](https://cve.now/CVE-2019-14513.md): Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read ope (no CVSS)
- [CVE-2019-14260](https://cve.now/CVE-2019-14260.md): On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input val (no CVSS)
- [CVE-2016-10813](https://cve.now/CVE-2016-10813.md): cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). (no CVSS)
- [CVE-2016-10814](https://cve.now/CVE-2016-10814.md): cPanel before 57.9999.54 allows demo-mode escape via show\_template.stor (SEC-119). (no CVSS)
- [CVE-2016-10815](https://cve.now/CVE-2016-10815.md): cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). (no CVSS)
- [CVE-2016-10816](https://cve.now/CVE-2016-10816.md): cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). (no CVSS)
- [CVE-2016-10817](https://cve.now/CVE-2016-10817.md): cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). (no CVSS)
- [CVE-2016-10818](https://cve.now/CVE-2016-10818.md): cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). (no CVSS)
- [CVE-2016-10819](https://cve.now/CVE-2016-10819.md): In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). (no CVSS)
- [CVE-2016-10820](https://cve.now/CVE-2016-10820.md): cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). (no CVSS)
- [CVE-2016-10821](https://cve.now/CVE-2016-10821.md): In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). (no CVSS)
- [CVE-2016-10826](https://cve.now/CVE-2016-10826.md): cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). (no CVSS)
- [CVE-2019-14497](https://cve.now/CVE-2019-14497.md): ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow. (no CVSS)
- [CVE-2019-14496](https://cve.now/CVE-2019-14496.md): LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow. (no CVSS)
- [CVE-2019-9140](https://cve.now/CVE-2019-9140.md): Happypoint mobile application information disclosure vulnerability (CVSS 7.8, SPC CLOUD Happypoint mobile app)
- [CVE-2019-14495](https://cve.now/CVE-2019-14495.md): webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface. (CVSS 5.8)
- [CVE-2016-10822](https://cve.now/CVE-2016-10822.md): cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). (no CVSS)
- [CVE-2016-10823](https://cve.now/CVE-2016-10823.md): cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). (no CVSS)
- [CVE-2016-10824](https://cve.now/CVE-2016-10824.md): cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). (no CVSS)
- [CVE-2016-10825](https://cve.now/CVE-2016-10825.md): cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). (no CVSS)
- [CVE-2016-10827](https://cve.now/CVE-2016-10827.md): cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96). (no CVSS)
- [CVE-2016-10828](https://cve.now/CVE-2016-10828.md): cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). (no CVSS)
- [CVE-2016-10829](https://cve.now/CVE-2016-10829.md): cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99). (no CVSS)
- [CVE-2016-10830](https://cve.now/CVE-2016-10830.md): cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic\_revision (SEC-100). (no CVSS)
- [CVE-2016-10831](https://cve.now/CVE-2016-10831.md): cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). (no CVSS)
- [CVE-2018-20953](https://cve.now/CVE-2018-20953.md): cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389). (no CVSS)
- [CVE-2018-20952](https://cve.now/CVE-2018-20952.md): cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388). (no CVSS)
- [CVE-2018-20951](https://cve.now/CVE-2018-20951.md): cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387). (no CVSS)
- [CVE-2018-20950](https://cve.now/CVE-2018-20950.md): cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386). (no CVSS)
- [CVE-2018-20949](https://cve.now/CVE-2018-20949.md): cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385). (no CVSS)
- [CVE-2018-20948](https://cve.now/CVE-2018-20948.md): cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383). (no CVSS)
- [CVE-2018-20947](https://cve.now/CVE-2018-20947.md): cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356). (no CVSS)
- [CVE-2018-20946](https://cve.now/CVE-2018-20946.md): cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive\_sync\_zones script (no CVSS)
- [CVE-2018-20945](https://cve.now/CVE-2018-20945.md): bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354). (no CVSS)
- [CVE-2018-20944](https://cve.now/CVE-2018-20944.md): cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353). (no CVSS)
- [CVE-2016-10832](https://cve.now/CVE-2016-10832.md): cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). (no CVSS)
- [CVE-2018-20943](https://cve.now/CVE-2018-20943.md): cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352). (no CVSS)
- [CVE-2018-20942](https://cve.now/CVE-2018-20942.md): cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351). (no CVSS)
- [CVE-2018-20941](https://cve.now/CVE-2018-20941.md): cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349). (no CVSS)
- [CVE-2016-10833](https://cve.now/CVE-2016-10833.md): cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). (no CVSS)
- [CVE-2018-20940](https://cve.now/CVE-2018-20940.md): cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342). (no CVSS)
- [CVE-2018-20939](https://cve.now/CVE-2018-20939.md): cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339). (no CVSS)
- [CVE-2018-20938](https://cve.now/CVE-2018-20938.md): cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). (no CVSS)
- [CVE-2016-10834](https://cve.now/CVE-2016-10834.md): cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). (no CVSS)
- [CVE-2018-20937](https://cve.now/CVE-2018-20937.md): cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321). (no CVSS)
- [CVE-2016-10835](https://cve.now/CVE-2016-10835.md): cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). (no CVSS)
- [CVE-2018-20936](https://cve.now/CVE-2018-20936.md): cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308). (no CVSS)
- [CVE-2019-14494](https://cve.now/CVE-2019-14494.md): An issue was discovered in Poppler through 0.78.0. (no CVSS)
- [CVE-2019-14493](https://cve.now/CVE-2019-14493.md): An issue was discovered in OpenCV before 4.1.1. (no CVSS, opencv-contrib-python-headless · opencv-python +2)
- [CVE-2019-14492](https://cve.now/CVE-2019-14492.md): An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. (no CVSS, opencv-contrib-python-headless · opencv-contrib-python +2)
- [CVE-2019-14491](https://cve.now/CVE-2019-14491.md): An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. (no CVSS, opencv-python-headless · opencv-python +2)
- [CVE-2016-10836](https://cve.now/CVE-2016-10836.md): cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). (no CVSS)
- [CVE-2018-20935](https://cve.now/CVE-2018-20935.md): cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412). (no CVSS)
- [CVE-2018-20934](https://cve.now/CVE-2018-20934.md): cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411). (no CVSS)
- [CVE-2018-20933](https://cve.now/CVE-2018-20933.md): cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410). (no CVSS)
- [CVE-2018-20932](https://cve.now/CVE-2018-20932.md): cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406). (no CVSS)
- [CVE-2018-20931](https://cve.now/CVE-2018-20931.md): cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405). (no CVSS)
- [CVE-2018-20930](https://cve.now/CVE-2018-20930.md): cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). (no CVSS)
- [CVE-2016-10837](https://cve.now/CVE-2016-10837.md): cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46). (no CVSS)
- [CVE-2016-10838](https://cve.now/CVE-2016-10838.md): cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). (no CVSS)
- [CVE-2018-20928](https://cve.now/CVE-2018-20928.md): cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391). (no CVSS)
- [CVE-2016-10839](https://cve.now/CVE-2016-10839.md): cPanel before 11.54.0.4 allows SQL injection in bin/horde\_update\_usernames (SEC-71). (no CVSS)
- [CVE-2016-10840](https://cve.now/CVE-2016-10840.md): cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72). (no CVSS)
- [CVE-2016-10841](https://cve.now/CVE-2016-10841.md): The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73). (no CVSS)
- [CVE-2016-10842](https://cve.now/CVE-2016-10842.md): cPanel before 11.54.0.4 allows certain file-read operations in bin/setup\_global\_spam\_filter.pl (SEC-74). (no CVSS)
- [CVE-2016-10843](https://cve.now/CVE-2016-10843.md): cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). (no CVSS)
- [CVE-2016-10844](https://cve.now/CVE-2016-10844.md): The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). (no CVSS)
- [CVE-2016-10845](https://cve.now/CVE-2016-10845.md): cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check\_system\_storable (SEC-78). (no CVSS)
- [CVE-2016-10846](https://cve.now/CVE-2016-10846.md): cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). (no CVSS)
- [CVE-2016-10847](https://cve.now/CVE-2016-10847.md): cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80). (no CVSS)
- [CVE-2016-10848](https://cve.now/CVE-2016-10848.md): cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81). (no CVSS)
- [CVE-2016-10849](https://cve.now/CVE-2016-10849.md): cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). (no CVSS)
- [CVE-2019-14486](https://cve.now/CVE-2019-14486.md): GnuCOBOL 2.2 has a buffer overflow in cb\_evaluate\_expr in cobc/field.c via crafted COBOL source code. (no CVSS)
- [CVE-2018-20929](https://cve.now/CVE-2018-20929.md): cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392). (no CVSS)
- [CVE-2018-20927](https://cve.now/CVE-2018-20927.md): cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382). (no CVSS)
- [CVE-2018-20926](https://cve.now/CVE-2018-20926.md): cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380). (no CVSS)
- [CVE-2018-20925](https://cve.now/CVE-2018-20925.md): cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379). (no CVSS)
- [CVE-2018-20924](https://cve.now/CVE-2018-20924.md): cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378). (no CVSS)
- [CVE-2016-10850](https://cve.now/CVE-2016-10850.md): cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). (no CVSS)
- [CVE-2018-20923](https://cve.now/CVE-2018-20923.md): cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377). (no CVSS)
- [CVE-2018-20922](https://cve.now/CVE-2018-20922.md): cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376). (no CVSS)
- [CVE-2018-20921](https://cve.now/CVE-2018-20921.md): cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375). (no CVSS)
- [CVE-2018-20920](https://cve.now/CVE-2018-20920.md): cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374). (no CVSS)
- [CVE-2018-20919](https://cve.now/CVE-2018-20919.md): cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373). (no CVSS)
- [CVE-2016-10851](https://cve.now/CVE-2016-10851.md): cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). (no CVSS)
- [CVE-2018-20918](https://cve.now/CVE-2018-20918.md): cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372). (no CVSS)
- [CVE-2016-10852](https://cve.now/CVE-2016-10852.md): cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). (no CVSS)
- [CVE-2018-20917](https://cve.now/CVE-2018-20917.md): cPanel before 70.0.23 allows any user to disable Solr (SEC-371). (no CVSS)
- [CVE-2018-20916](https://cve.now/CVE-2018-20916.md): cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370). (no CVSS)
- [CVE-2018-20915](https://cve.now/CVE-2018-20915.md): cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369). (no CVSS)
- [CVE-2016-10853](https://cve.now/CVE-2016-10853.md): cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86). (no CVSS)
- [CVE-2018-20914](https://cve.now/CVE-2018-20914.md): In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368). (no CVSS)
- [CVE-2019-14259](https://cve.now/CVE-2019-14259.md): On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP add (no CVSS)
- [CVE-2016-10854](https://cve.now/CVE-2016-10854.md): cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). (no CVSS)
- [CVE-2018-20913](https://cve.now/CVE-2018-20913.md): cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364). (no CVSS)
- [CVE-2018-20912](https://cve.now/CVE-2018-20912.md): cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). (no CVSS)
- [CVE-2016-10855](https://cve.now/CVE-2016-10855.md): cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91). (no CVSS)
- [CVE-2018-20911](https://cve.now/CVE-2018-20911.md): cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359). (no CVSS)
- [CVE-2016-10856](https://cve.now/CVE-2016-10856.md): cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). (no CVSS)
- [CVE-2016-10857](https://cve.now/CVE-2016-10857.md): cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). (no CVSS)
- [CVE-2016-10858](https://cve.now/CVE-2016-10858.md): cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). (no CVSS)
- [CVE-2016-10859](https://cve.now/CVE-2016-10859.md): cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65). (no CVSS)
- [CVE-2019-13572](https://cve.now/CVE-2019-13572.md): The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. (no CVSS)
- [CVE-2016-10860](https://cve.now/CVE-2016-10860.md): cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). (no CVSS)
- [CVE-2015-9291](https://cve.now/CVE-2015-9291.md): cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get\_information\_for\_applications (CPANEL-1221). (no CVSS)
- [CVE-2018-20910](https://cve.now/CVE-2018-20910.md): cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357). (no CVSS)
- [CVE-2018-20909](https://cve.now/CVE-2018-20909.md): cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). (no CVSS)
- [CVE-2018-20908](https://cve.now/CVE-2018-20908.md): cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). (no CVSS)
- [CVE-2018-20907](https://cve.now/CVE-2018-20907.md): cPanel before 71.9980.37 does not enforce the Mime::list\_hotlinks API feature restriction (SEC-432). (no CVSS)
- [CVE-2018-20906](https://cve.now/CVE-2018-20906.md): cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430). (no CVSS)
- [CVE-2018-20905](https://cve.now/CVE-2018-20905.md): cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). (no CVSS)
- [CVE-2018-20904](https://cve.now/CVE-2018-20904.md): cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427). (no CVSS)
- [CVE-2018-20903](https://cve.now/CVE-2018-20903.md): cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421). (no CVSS)
- [CVE-2013-7473](https://cve.now/CVE-2013-7473.md): Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. (no CVSS)
- [CVE-2018-20902](https://cve.now/CVE-2018-20902.md): cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408). (no CVSS)
- [CVE-2018-20901](https://cve.now/CVE-2018-20901.md): cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400). (no CVSS)
- [CVE-2013-7474](https://cve.now/CVE-2013-7474.md): Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. (no CVSS)
- [CVE-2019-14472](https://cve.now/CVE-2019-14472.md): Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH\_INFO. (no CVSS)
- [CVE-2019-14471](https://cve.now/CVE-2019-14471.md): TestLink 1.9.19 has XSS via the error.php message parameter. (no CVSS)
- [CVE-2018-20900](https://cve.now/CVE-2018-20900.md): cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399). (no CVSS)
- [CVE-2018-20899](https://cve.now/CVE-2018-20899.md): cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398). (no CVSS)
- [CVE-2018-20898](https://cve.now/CVE-2018-20898.md): cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396). (no CVSS)
- [CVE-2018-20897](https://cve.now/CVE-2018-20897.md): cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). (no CVSS)
- [CVE-2018-20896](https://cve.now/CVE-2018-20896.md): cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394). (no CVSS)
- [CVE-2019-0193](https://cve.now/CVE-2019-0193.md): In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi (CVSS 7.2, KEV, Apache Solr · org.apache.solr:solr-core)
- [CVE-2018-20895](https://cve.now/CVE-2018-20895.md): In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393). (no CVSS)
- [CVE-2014-8183](https://cve.now/CVE-2014-8183.md): It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. (CVSS 7.4, theforeman foreman)
- [CVE-2018-10899](https://cve.now/CVE-2018-10899.md): A flaw was found in Jolokia versions from 1.2 to before 1.6.1. (CVSS 8.1, jolokia · org.jolokia:jolokia-core)
- [CVE-2019-3890](https://cve.now/CVE-2019-3890.md): It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. (CVSS 8.1, The Gnome Project evolution-ews)
- [CVE-2019-3884](https://cve.now/CVE-2019-3884.md): A vulnerability exists in the garbage collection mechanism of atomic-openshift. (CVSS 3.6, Red Hat atomic-openshift)
- [CVE-2018-20894](https://cve.now/CVE-2018-20894.md): cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443). (no CVSS)
- [CVE-2018-20893](https://cve.now/CVE-2018-20893.md): cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442). (no CVSS)
- [CVE-2018-20892](https://cve.now/CVE-2018-20892.md): cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439). (no CVSS)
- [CVE-2018-20891](https://cve.now/CVE-2018-20891.md): cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436). (no CVSS)
- [CVE-2018-20890](https://cve.now/CVE-2018-20890.md): cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). (no CVSS)
- [CVE-2018-20889](https://cve.now/CVE-2018-20889.md): cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425). (no CVSS)
- [CVE-2018-20888](https://cve.now/CVE-2018-20888.md): cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). (no CVSS)
- [CVE-2018-20887](https://cve.now/CVE-2018-20887.md): cPanel before 74.0.0 allows SQL injection during database backups (SEC-420). (no CVSS)
- [CVE-2018-20886](https://cve.now/CVE-2018-20886.md): cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418). (no CVSS)
- [CVE-2018-20885](https://cve.now/CVE-2018-20885.md): cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416). (no CVSS)
- [CVE-2018-20884](https://cve.now/CVE-2018-20884.md): cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367). (no CVSS)
- [CVE-2019-14468](https://cve.now/CVE-2019-14468.md): GnuCOBOL 2.2 has a buffer overflow in cb\_push\_op in cobc/field.c via crafted COBOL source code. (no CVSS)
- [CVE-2018-20883](https://cve.now/CVE-2018-20883.md): cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). (no CVSS)
- [CVE-2018-20882](https://cve.now/CVE-2018-20882.md): cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447). (no CVSS)
- [CVE-2018-20881](https://cve.now/CVE-2018-20881.md): cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446). (no CVSS)
- [CVE-2018-20880](https://cve.now/CVE-2018-20880.md): cPanel before 74.0.8 mishandles account suspension because of an invalid email\_accounts.json file (SEC-445). (no CVSS)
- [CVE-2018-20879](https://cve.now/CVE-2018-20879.md): cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). (no CVSS)
- [CVE-2018-20878](https://cve.now/CVE-2018-20878.md): cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441). (no CVSS)
- [CVE-2018-20877](https://cve.now/CVE-2018-20877.md): cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437). (no CVSS)
- [CVE-2018-20876](https://cve.now/CVE-2018-20876.md): cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434). (no CVSS)
- [CVE-2018-20875](https://cve.now/CVE-2018-20875.md): cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433). (no CVSS)
- [CVE-2018-20874](https://cve.now/CVE-2018-20874.md): cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428). (no CVSS)
- [CVE-2018-20873](https://cve.now/CVE-2018-20873.md): cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409). (no CVSS)
- [CVE-2019-14338](https://cve.now/CVE-2019-14338.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14337](https://cve.now/CVE-2019-14337.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14336](https://cve.now/CVE-2019-14336.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14334](https://cve.now/CVE-2019-14334.md): An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14333](https://cve.now/CVE-2019-14333.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14332](https://cve.now/CVE-2019-14332.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2015-7559](https://cve.now/CVE-2015-7559.md): It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. (CVSS 2.7, Apache ActiveMQ · org.apache.activemq:activemq-client)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.