1380 matches found
CVE-2012-1156
Moodle vulnerability CVE-2012-1156 affects Moodle releases prior to 2.2.2, where private user files could be included in course backups. Connected advisories/cve listings confirm affected versions across 2.0–2.2.x (e.g., 2.0–2.0.7+, 2.1–2.1.4+, 2.2–2.2.1+) and describe this as a design/logic flaw...
CISA Launches “Cyber Essentials” for Small Businesses and Small SLTT Governments
The Cybersecurity and Infrastructure Security Agency CISA has launched Cyber Essentials, an effort to assist small organizations in understanding and addressing cybersecurity risks. Developed in partnership with small businesses and small state, local, tribal, and territorial SLTT governments,...
U.S. Dept Of Defense: Directory Indexing on the ████ (https://████/) leads to the backups disclosure and credentials leak
Description During poking around █████████/24 range - █████ looking for the Cisco devices, I came across █████ which resolved to the https://██████/ While it's a not .mil host, it's likely related to the DoD since it hosted in the DoD-controlled ASN. I discovered few critical vulnerabilities here...
CVE-2019-11029
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This...
cPanel Authorization Issues Vulnerability (CNVD-2019-29606)
cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. The security vulnerability in cPanel versions prior to 68.0.15 stems from the program assigning weak privileges for...
cPanel Privilege Permission and Access Control Issues Vulnerability (CNVD-2019-29608)
cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in cPanel versions prior to 68.0.15, which stems from the program writing backup files o...
CVE-2017-18383
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
CVE-2017-18390
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...
CVE-2017-18383
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Design/Logic Flaw
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Code injection
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...
CVE-2017-18390
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...
CVE-2017-18390
CVE-2017-18390 affects cPanel prior to 68.0.15. It enables code execution in the root context due to weak permissions on incremental backups (SEC-322). The vulnerability is documented as high-severity with local access requirements. Remediation: upgrade to 68.0.15 or later. Exploitation details a...
CVE-2018-20940
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups SEC-342...
CVE-2018-20939
cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...
Code injection
cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...
CVE-2018-20940
CVE-2018-20940 affects cPanel prior to 68.0.27. The (local) vulnerability allows an attacker to read the root user’s crontab file for a brief window when backups are enabled. Exploitation details are not provided in the connected documents, and there is no explicit remediation or patch informatio...
CVE-2018-20939
CVE-2018-20939 affects cPanel prior to 68.0.27 and causes information disclosure by enabling a user to discover contents of directories not owned by that user through backups. The root cause is an improper handling of backups that exposes directory listings, enabling partial confidentiality loss ...