# CVEs published 2019-08-02

182 CVEs were published on August 2, 2019: 0 critical, 7 high. Days are UTC.

- [CVE-2019-7853](https://cve.now/CVE-2019-7853.md): A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7951](https://cve.now/CVE-2019-7951.md): An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7950](https://cve.now/CVE-2019-7950.md): An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7947](https://cve.now/CVE-2019-7947.md): A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magen (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7945](https://cve.now/CVE-2019-7945.md): A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7944](https://cve.now/CVE-2019-7944.md): A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commer (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7942](https://cve.now/CVE-2019-7942.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7940](https://cve.now/CVE-2019-7940.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento)
- [CVE-2019-7939](https://cve.now/CVE-2019-7939.md): A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior t (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7938](https://cve.now/CVE-2019-7938.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition +3)
- [CVE-2019-7937](https://cve.now/CVE-2019-7937.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7936](https://cve.now/CVE-2019-7936.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7935](https://cve.now/CVE-2019-7935.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7934](https://cve.now/CVE-2019-7934.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7932](https://cve.now/CVE-2019-7932.md): A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 pr (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7930](https://cve.now/CVE-2019-7930.md): A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7929](https://cve.now/CVE-2019-7929.md): An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7928](https://cve.now/CVE-2019-7928.md): A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7927](https://cve.now/CVE-2019-7927.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7926](https://cve.now/CVE-2019-7926.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7925](https://cve.now/CVE-2019-7925.md): An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prio (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7923](https://cve.now/CVE-2019-7923.md): A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2 (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7921](https://cve.now/CVE-2019-7921.md): A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, M (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7915](https://cve.now/CVE-2019-7915.md): A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7913](https://cve.now/CVE-2019-7913.md): A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2 (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7912](https://cve.now/CVE-2019-7912.md): A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7911](https://cve.now/CVE-2019-7911.md): A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, M (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7909](https://cve.now/CVE-2019-7909.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7908](https://cve.now/CVE-2019-7908.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7904](https://cve.now/CVE-2019-7904.md): Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 coul (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7903](https://cve.now/CVE-2019-7903.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7899](https://cve.now/CVE-2019-7899.md): Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4. (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7898](https://cve.now/CVE-2019-7898.md): Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Ma (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7897](https://cve.now/CVE-2019-7897.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7896](https://cve.now/CVE-2019-7896.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7895](https://cve.now/CVE-2019-7895.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7892](https://cve.now/CVE-2019-7892.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7890](https://cve.now/CVE-2019-7890.md): An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7889](https://cve.now/CVE-2019-7889.md): An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1. (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7888](https://cve.now/CVE-2019-7888.md): An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7887](https://cve.now/CVE-2019-7887.md): A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7886](https://cve.now/CVE-2019-7886.md): A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7885](https://cve.now/CVE-2019-7885.md): Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7882](https://cve.now/CVE-2019-7882.md): A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7881](https://cve.now/CVE-2019-7881.md): A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7880](https://cve.now/CVE-2019-7880.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7877](https://cve.now/CVE-2019-7877.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7876](https://cve.now/CVE-2019-7876.md): A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition +1)
- [CVE-2019-7875](https://cve.now/CVE-2019-7875.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7874](https://cve.now/CVE-2019-7874.md): A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7873](https://cve.now/CVE-2019-7873.md): A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-14544](https://cve.now/CVE-2019-14544.md): routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. (no CVSS, gogs.io/gogs)
- [CVE-2019-7872](https://cve.now/CVE-2019-7872.md): An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prio (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7871](https://cve.now/CVE-2019-7871.md): A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to exec (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7869](https://cve.now/CVE-2019-7869.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7868](https://cve.now/CVE-2019-7868.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7867](https://cve.now/CVE-2019-7867.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7866](https://cve.now/CVE-2019-7866.md): A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7865](https://cve.now/CVE-2019-7865.md): A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2. (no CVSS, Magento · magento/community-edition +1)
- [CVE-2019-7864](https://cve.now/CVE-2019-7864.md): An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7863](https://cve.now/CVE-2019-7863.md): A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2 (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7862](https://cve.now/CVE-2019-7862.md): A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior t (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7861](https://cve.now/CVE-2019-7861.md): Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7860](https://cve.now/CVE-2019-7860.md): A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magent (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7859](https://cve.now/CVE-2019-7859.md): A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7858](https://cve.now/CVE-2019-7858.md): A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensit (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7857](https://cve.now/CVE-2019-7857.md): A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7855](https://cve.now/CVE-2019-7855.md): A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthentic (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7854](https://cve.now/CVE-2019-7854.md): An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7852](https://cve.now/CVE-2019-7852.md): A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7851](https://cve.now/CVE-2019-7851.md): A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead t (no CVSS, Magento · magento/community-edition)
- [CVE-2019-7849](https://cve.now/CVE-2019-7849.md): A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. (no CVSS, Magento 1 Magento · magento/community-edition)
- [CVE-2019-7163](https://cve.now/CVE-2019-7163.md): The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40\_LU\_02.00\_02 devices is vulnerable to an authentication bypass that allows an unauthen (no CVSS)
- [CVE-2019-6969](https://cve.now/CVE-2019-6969.md): The web interface of the D-Link DVA-5592 20180823 is vulnerable to an authentication bypass that allows an unauthenticated user to have acce (no CVSS)
- [CVE-2019-6968](https://cve.now/CVE-2019-6968.md): The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected. (no CVSS)
- [CVE-2019-14541](https://cve.now/CVE-2019-14541.md): GnuCOBOL 2.2 has a stack-based buffer overflow in cb\_encode\_program\_id in cobc/typeck.c via crafted COBOL source code. (no CVSS)
- [CVE-2019-10088](https://cve.now/CVE-2019-10088.md): A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. (no CVSS, Apache Tika · org.apache.tika:tika-core)
- [CVE-2019-10094](https://cve.now/CVE-2019-10094.md): A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in (no CVSS, Apache Tika · org.apache.tika:tika-core)
- [CVE-2019-10093](https://cve.now/CVE-2019-10093.md): In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very l (no CVSS, Apache Tika · org.apache.tika:tika-parsers)
- [CVE-2017-18463](https://cve.now/CVE-2017-18463.md): cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). (no CVSS)
- [CVE-2017-18461](https://cve.now/CVE-2017-18461.md): cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). (no CVSS)
- [CVE-2017-18460](https://cve.now/CVE-2017-18460.md): cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). (no CVSS)
- [CVE-2017-18459](https://cve.now/CVE-2017-18459.md): cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). (no CVSS)
- [CVE-2017-18458](https://cve.now/CVE-2017-18458.md): cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). (no CVSS)
- [CVE-2017-18457](https://cve.now/CVE-2017-18457.md): cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). (no CVSS)
- [CVE-2017-18456](https://cve.now/CVE-2017-18456.md): cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). (no CVSS)
- [CVE-2017-18455](https://cve.now/CVE-2017-18455.md): In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). (no CVSS)
- [CVE-2017-18454](https://cve.now/CVE-2017-18454.md): cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). (no CVSS)
- [CVE-2017-18453](https://cve.now/CVE-2017-18453.md): cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). (no CVSS)
- [CVE-2017-18452](https://cve.now/CVE-2017-18452.md): cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). (no CVSS)
- [CVE-2017-18451](https://cve.now/CVE-2017-18451.md): cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). (no CVSS)
- [CVE-2017-18450](https://cve.now/CVE-2017-18450.md): cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert\_roundcube\_mysql2sqlite (SEC-255). (no CVSS)
- [CVE-2017-18449](https://cve.now/CVE-2017-18449.md): cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert\_roundcube\_mysql2sqlite (S (no CVSS)
- [CVE-2017-18448](https://cve.now/CVE-2017-18448.md): cPanel before 64.0.21 allows certain file-read operations via a Serverinfo\_manpage API call (SEC-252). (no CVSS)
- [CVE-2017-18447](https://cve.now/CVE-2017-18447.md): cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner\_getsocket API (SEC-251). (no CVSS)
- [CVE-2017-18446](https://cve.now/CVE-2017-18446.md): cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). (no CVSS)
- [CVE-2017-18445](https://cve.now/CVE-2017-18445.md): cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). (no CVSS)
- [CVE-2017-18444](https://cve.now/CVE-2017-18444.md): cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). (no CVSS)
- [CVE-2017-18443](https://cve.now/CVE-2017-18443.md): cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). (no CVSS)
- [CVE-2017-18442](https://cve.now/CVE-2017-18442.md): cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). (no CVSS)
- [CVE-2017-18441](https://cve.now/CVE-2017-18441.md): cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). (no CVSS)
- [CVE-2017-18440](https://cve.now/CVE-2017-18440.md): cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). (no CVSS)
- [CVE-2017-18439](https://cve.now/CVE-2017-18439.md): cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager\_dimensions API call (SEC-243). (no CVSS)
- [CVE-2017-18438](https://cve.now/CVE-2017-18438.md): cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). (no CVSS)
- [CVE-2017-18437](https://cve.now/CVE-2017-18437.md): cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). (no CVSS)
- [CVE-2017-18436](https://cve.now/CVE-2017-18436.md): cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). (no CVSS)
- [CVE-2019-10961](https://cve.now/CVE-2019-10961.md): In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user sup (no CVSS, Advantech WebAccess HMI Designer)
- [CVE-2017-18435](https://cve.now/CVE-2017-18435.md): cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). (no CVSS)
- [CVE-2017-18434](https://cve.now/CVE-2017-18434.md): cPanel before 64.0.21 allows code execution in the context of the root account via a SET\_VHOST\_LANG\_PACKAGE multilang adminbin call (SEC-237 (no CVSS)
- [CVE-2017-18433](https://cve.now/CVE-2017-18433.md): cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store\_filter API call (SEC-236). (no CVSS)
- [CVE-2017-18432](https://cve.now/CVE-2017-18432.md): In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). (no CVSS)
- [CVE-2017-18431](https://cve.now/CVE-2017-18431.md): cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). (no CVSS)
- [CVE-2017-18430](https://cve.now/CVE-2017-18430.md): In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign\_post\_terminate\_cruft (SEC-294). (no CVSS)
- [CVE-2017-18429](https://cve.now/CVE-2017-18429.md): In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). (no CVSS)
- [CVE-2019-9141](https://cve.now/CVE-2019-9141.md): Zoneplayer ActiveX Remote Code Execution vulnerability (CVSS 8.8, IMGTech Co ZInsVX.dll ActiveX Control)
- [CVE-2017-18428](https://cve.now/CVE-2017-18428.md): In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). (no CVSS)
- [CVE-2017-18427](https://cve.now/CVE-2017-18427.md): In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). (no CVSS)
- [CVE-2017-18426](https://cve.now/CVE-2017-18426.md): cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). (no CVSS)
- [CVE-2017-18425](https://cve.now/CVE-2017-18425.md): In cPanel before 66.0.2, the cpdavd\_error\_log file can be created with weak permissions (SEC-280). (no CVSS)
- [CVE-2017-18424](https://cve.now/CVE-2017-18424.md): In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). (no CVSS)
- [CVE-2017-18423](https://cve.now/CVE-2017-18423.md): In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). (no CVSS)
- [CVE-2017-18422](https://cve.now/CVE-2017-18422.md): In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). (no CVSS)
- [CVE-2017-18421](https://cve.now/CVE-2017-18421.md): cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). (no CVSS)
- [CVE-2017-18420](https://cve.now/CVE-2017-18420.md): cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269). (no CVSS)
- [CVE-2017-18419](https://cve.now/CVE-2017-18419.md): cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266). (no CVSS)
- [CVE-2017-18418](https://cve.now/CVE-2017-18418.md): cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265). (no CVSS)
- [CVE-2017-18417](https://cve.now/CVE-2017-18417.md): cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263). (no CVSS)
- [CVE-2019-5501](https://cve.now/CVE-2019-5501.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers (no CVSS, NetApp Data ONTAP operating in 7-Mode)
- [CVE-2019-5493](https://cve.now/CVE-2019-5493.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticate (no CVSS, Netapp Data ONTAP operating in 7-Mode)
- [CVE-2019-14235](https://cve.now/CVE-2019-14235.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-14233](https://cve.now/CVE-2019-14233.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-4275](https://cve.now/CVE-2019-4275.md): IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could (CVSS 6.2, IBM Jazz for Service Management)
- [CVE-2018-1987](https://cve.now/CVE-2018-1987.md): IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be di (CVSS 5.1, IBM Spectrum Protect for Enterprise Resource Planning)
- [CVE-2019-14531](https://cve.now/CVE-2019-14531.md): An issue was discovered in The Sleuth Kit (TSK) 4.6.6. (no CVSS)
- [CVE-2019-14532](https://cve.now/CVE-2019-14532.md): An issue was discovered in The Sleuth Kit (TSK) 4.6.6. (no CVSS)
- [CVE-2019-10938](https://cve.now/CVE-2019-10938.md): A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions \< V7.59), SIPROTEC 5 devices with CPU varian (no CVSS, Siemens AG SIPROTEC 5 devices with CPU variants CP200 ·… +1)
- [CVE-2017-18416](https://cve.now/CVE-2017-18416.md): cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). (no CVSS)
- [CVE-2017-18415](https://cve.now/CVE-2017-18415.md): cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (S (no CVSS)
- [CVE-2017-18414](https://cve.now/CVE-2017-18414.md): cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). (no CVSS)
- [CVE-2017-18413](https://cve.now/CVE-2017-18413.md): In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299). (no CVSS)
- [CVE-2019-10176](https://cve.now/CVE-2019-10176.md): A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component we (CVSS 4.2, RedHat atomic-openshift)
- [CVE-2017-18412](https://cve.now/CVE-2017-18412.md): cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296) (no CVSS)
- [CVE-2017-18411](https://cve.now/CVE-2017-18411.md): The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). (no CVSS)
- [CVE-2019-10171](https://cve.now/CVE-2019-10171.md): It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. (CVSS 7.5, RedHat 389-ds-base)
- [CVE-2017-18410](https://cve.now/CVE-2017-18410.md): In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). (no CVSS)
- [CVE-2017-18409](https://cve.now/CVE-2017-18409.md): In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). (no CVSS)
- [CVE-2017-18408](https://cve.now/CVE-2017-18408.md): cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). (no CVSS)
- [CVE-2017-18407](https://cve.now/CVE-2017-18407.md): cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279). (no CVSS)
- [CVE-2019-14529](https://cve.now/CVE-2019-14529.md): OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye\_mag/save.php. (no CVSS)
- [CVE-2017-18406](https://cve.now/CVE-2017-18406.md): cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). (no CVSS)
- [CVE-2019-14528](https://cve.now/CVE-2019-14528.md): GnuCOBOL 2.2 has a heap-based buffer overflow in read\_literal in cobc/scanner.l via crafted COBOL source code. (no CVSS)
- [CVE-2017-18405](https://cve.now/CVE-2017-18405.md): cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). (no CVSS)
- [CVE-2017-18404](https://cve.now/CVE-2017-18404.md): cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). (no CVSS)
- [CVE-2017-18403](https://cve.now/CVE-2017-18403.md): cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). (no CVSS)
- [CVE-2017-18402](https://cve.now/CVE-2017-18402.md): cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336). (no CVSS)
- [CVE-2017-18401](https://cve.now/CVE-2017-18401.md): cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). (no CVSS)
- [CVE-2017-18400](https://cve.now/CVE-2017-18400.md): cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). (no CVSS)
- [CVE-2017-18399](https://cve.now/CVE-2017-18399.md): cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC (no CVSS)
- [CVE-2017-18398](https://cve.now/CVE-2017-18398.md): DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). (no CVSS)
- [CVE-2017-18397](https://cve.now/CVE-2017-18397.md): cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330). (no CVSS)
- [CVE-2017-18396](https://cve.now/CVE-2017-18396.md): cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). (no CVSS)
- [CVE-2017-18395](https://cve.now/CVE-2017-18395.md): cPanel before 68.0.15 does not block a username of ssl (SEC-328). (no CVSS)
- [CVE-2017-18394](https://cve.now/CVE-2017-18394.md): cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). (no CVSS)
- [CVE-2017-18393](https://cve.now/CVE-2017-18393.md): cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). (no CVSS)
- [CVE-2017-18392](https://cve.now/CVE-2017-18392.md): cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). (no CVSS)
- [CVE-2017-18391](https://cve.now/CVE-2017-18391.md): cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). (no CVSS)
- [CVE-2017-18390](https://cve.now/CVE-2017-18390.md): cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). (no CVSS)
- [CVE-2017-18389](https://cve.now/CVE-2017-18389.md): cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). (no CVSS)
- [CVE-2017-18388](https://cve.now/CVE-2017-18388.md): cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). (no CVSS)
- [CVE-2017-18387](https://cve.now/CVE-2017-18387.md): cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). (no CVSS)
- [CVE-2017-18386](https://cve.now/CVE-2017-18386.md): cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). (no CVSS)
- [CVE-2017-18385](https://cve.now/CVE-2017-18385.md): cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). (no CVSS)
- [CVE-2017-18384](https://cve.now/CVE-2017-18384.md): cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). (no CVSS)
- [CVE-2017-18383](https://cve.now/CVE-2017-18383.md): cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). (no CVSS)
- [CVE-2017-18382](https://cve.now/CVE-2017-18382.md): cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). (no CVSS)
- [CVE-2019-10168](https://cve.now/CVE-2019-10168.md): The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept (CVSS 8.8, libvirt)
- [CVE-2019-10167](https://cve.now/CVE-2019-10167.md): The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to (CVSS 8.8, libvirt)
- [CVE-2019-10166](https://cve.now/CVE-2019-10166.md): It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainMana (CVSS 7.8, libvirt)
- [CVE-2014-8184](https://cve.now/CVE-2014-8184.md): A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. (CVSS 7.8, liblouis)
- [CVE-2019-14523](https://cve.now/CVE-2019-14523.md): An issue was discovered in Schism Tracker through 20190722. (no CVSS)
- [CVE-2019-14524](https://cve.now/CVE-2019-14524.md): An issue was discovered in Schism Tracker through 20190722. (no CVSS)
- [CVE-2019-14232](https://cve.now/CVE-2019-14232.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (CVSS 7.5, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.