CVEs published August 2, 2019
182 CVEs were published on August 2, 2019: 0 critical, 7 high.
- Published
- 182
- Critical
- 0
- High
- 7
- Medium
- 3
- Low
- 0
- Unrated
- 172
- Now in CISA KEV
- 0
- Fix available
- 77
Most affected products
- Magento · magento/community-edition
- 51
- Magento 1 Magento · magento/community-edition
- 16
- django
- 3
- libvirt
- 3
- Apache Tika · org.apache.tika:tika-core
- 2
- Magento · magento/community-edition +1
- 2
- Advantech WebAccess HMI Designer
- 1
- Apache Tika · org.apache.tika:tika-parsers
- 1
- gogs.io/gogs
- 1
- IBM Jazz for Service Management
- 1
High 7
- CVE-2019-9141Zoneplayer ActiveX Remote Code Execution vulnerabilityIMGTech Co ZInsVX.dll ActiveX Control
- CVE-2019-10171It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5.RedHat 389-ds-base
- CVE-2019-10168The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept libvirt
- CVE-2019-10167The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument tolibvirt
- CVE-2019-10166It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManalibvirt
- CVE-2014-8184A vulnerability was found in liblouis, versions 2.5.x before 2.5.4.liblouis
- CVE-2019-14232An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
Medium, low and unrated 175
- CVE-2019-7853A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7951An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7950An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7947A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and MagenMagento 1 Magento · magento/community-edition
- CVE-2019-7945A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento Magento 1 Magento · magento/community-edition
- CVE-2019-7944A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento CommerMagento 1 Magento · magento/community-edition
- CVE-2019-7942A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7940A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento
- CVE-2019-7939A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior tMagento · magento/community-edition
- CVE-2019-7938A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition +3
- CVE-2019-7937A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7936A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7935A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition
- CVE-2019-7934A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition
- CVE-2019-7932A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prMagento 1 Magento · magento/community-edition
- CVE-2019-7930A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7929An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7928A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7927A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7926A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7925An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prioMagento · magento/community-edition
- CVE-2019-7923A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2Magento · magento/community-edition
- CVE-2019-7921A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, MMagento · magento/community-edition
- CVE-2019-7915A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7913A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2Magento · magento/community-edition
- CVE-2019-7912A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7911A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, MMagento 1 Magento · magento/community-edition
- CVE-2019-7909A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition
- CVE-2019-7908A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7904Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 coulMagento · magento/community-edition
- CVE-2019-7903A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7899Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.Magento 1 Magento · magento/community-edition
- CVE-2019-7898Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, MaMagento 1 Magento · magento/community-edition
- CVE-2019-7897A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition
- CVE-2019-7896A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7895A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7892A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7890An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2Magento · magento/community-edition
- CVE-2019-7889An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.Magento 1 Magento · magento/community-edition
- CVE-2019-7888An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7887A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce priorMagento 1 Magento · magento/community-edition
- CVE-2019-7886A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7885Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior toMagento · magento/community-edition
- CVE-2019-7882A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce priorMagento 1 Magento · magento/community-edition
- CVE-2019-7881A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7880A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7877A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7876A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition +1
- CVE-2019-7875A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toMagento 1 Magento · magento/community-edition
- CVE-2019-7874A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7873A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-14544routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.gogs.io/gogs
- CVE-2019-7872An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prioMagento · magento/community-edition
- CVE-2019-7871A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execMagento · magento/community-edition
- CVE-2019-7869A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7868A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7867A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7866A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.Magento · magento/community-edition
- CVE-2019-7865A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.Magento · magento/community-edition +1
- CVE-2019-7864An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9,Magento · magento/community-edition
- CVE-2019-7863A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2Magento · magento/community-edition
- CVE-2019-7862A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior tMagento · magento/community-edition
- CVE-2019-7861Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18,Magento · magento/community-edition
- CVE-2019-7860A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, MagentMagento · magento/community-edition
- CVE-2019-7859A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2Magento · magento/community-edition
- CVE-2019-7858A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitMagento · magento/community-edition
- CVE-2019-7857A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause Magento · magento/community-edition
- CVE-2019-7855A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticMagento · magento/community-edition
- CVE-2019-7854An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.Magento · magento/community-edition
- CVE-2019-7852A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.Magento · magento/community-edition
- CVE-2019-7851A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead tMagento · magento/community-edition
- CVE-2019-7849A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules.Magento 1 Magento · magento/community-edition
- CVE-2019-7163The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthen
- CVE-2019-6969The web interface of the D-Link DVA-5592 20180823 is vulnerable to an authentication bypass that allows an unauthenticated user to have acce
- CVE-2019-6968The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.
- CVE-2019-14541GnuCOBOL 2.2 has a stack-based buffer overflow in cb_encode_program_id in cobc/typeck.c via crafted COBOL source code.
- CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21.Apache Tika · org.apache.tika:tika-core
- CVE-2019-10094A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika · org.apache.tika:tika-core
- CVE-2019-10093In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very lApache Tika · org.apache.tika:tika-parsers
- CVE-2017-18463cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
- CVE-2017-18461cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
- CVE-2017-18460cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).
- CVE-2017-18459cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).
- CVE-2017-18458cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
- CVE-2017-18457cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
- CVE-2017-18456cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
- CVE-2017-18455In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
- CVE-2017-18454cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
- CVE-2017-18453cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
- CVE-2017-18452cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
- CVE-2017-18451cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
- CVE-2017-18450cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
- CVE-2017-18449cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (S
- CVE-2017-18448cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
- CVE-2017-18447cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
- CVE-2017-18446cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
- CVE-2017-18445cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
- CVE-2017-18444cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
- CVE-2017-18443cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
- CVE-2017-18442cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
- CVE-2017-18441cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
- CVE-2017-18440cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
- CVE-2017-18439cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
- CVE-2017-18438cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
- CVE-2017-18437cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
- CVE-2017-18436cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
- CVE-2019-10961In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supAdvantech WebAccess HMI Designer
- CVE-2017-18435cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
- CVE-2017-18434cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237
- CVE-2017-18433cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
- CVE-2017-18432In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
- CVE-2017-18431cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
- CVE-2017-18430In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
- CVE-2017-18429In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
- CVE-2017-18428In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
- CVE-2017-18427In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
- CVE-2017-18426cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
- CVE-2017-18425In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
- CVE-2017-18424In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
- CVE-2017-18423In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
- CVE-2017-18422In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
- CVE-2017-18421cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
- CVE-2017-18420cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
- CVE-2017-18419cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
- CVE-2017-18418cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
- CVE-2017-18417cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
- CVE-2019-5501Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackersNetApp Data ONTAP operating in 7-Mode
- CVE-2019-5493Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticateNetapp Data ONTAP operating in 7-Mode
- CVE-2019-14235An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-14233An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-4275IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that couldIBM Jazz for Service Management
- CVE-2018-1987IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be diIBM Spectrum Protect for Enterprise Resource Planning
- CVE-2019-14531An issue was discovered in The Sleuth Kit (TSK) 4.6.6.
- CVE-2019-14532An issue was discovered in The Sleuth Kit (TSK) 4.6.6.
- CVE-2019-10938A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU varianSiemens AG SIPROTEC 5 devices with CPU variants CP200 ·… +1
- CVE-2017-18416cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
- CVE-2017-18415cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (S
- CVE-2017-18414cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
- CVE-2017-18413In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
- CVE-2019-10176A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component weRedHat atomic-openshift
- CVE-2017-18412cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296)
- CVE-2017-18411The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
- CVE-2017-18410In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
- CVE-2017-18409In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
- CVE-2017-18408cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
- CVE-2017-18407cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
- CVE-2019-14529OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
- CVE-2017-18406cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
- CVE-2019-14528GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.
- CVE-2017-18405cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
- CVE-2017-18404cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
- CVE-2017-18403cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
- CVE-2017-18402cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
- CVE-2017-18401cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
- CVE-2017-18400cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
- CVE-2017-18399cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC
- CVE-2017-18398DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
- CVE-2017-18397cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
- CVE-2017-18396cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
- CVE-2017-18395cPanel before 68.0.15 does not block a username of ssl (SEC-328).
- CVE-2017-18394cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
- CVE-2017-18393cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
- CVE-2017-18392cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).
- CVE-2017-18391cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
- CVE-2017-18390cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
- CVE-2017-18389cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
- CVE-2017-18388cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
- CVE-2017-18387cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).
- CVE-2017-18386cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).
- CVE-2017-18385cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
- CVE-2017-18384cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
- CVE-2017-18383cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
- CVE-2017-18382cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
- CVE-2019-14523An issue was discovered in Schism Tracker through 20190722.
- CVE-2019-14524An issue was discovered in Schism Tracker through 20190722.