CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

Design/Logic Flaw

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

Code injection

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18407

CVE-2017-18407 affects cPanel before 67.9999.103, where SSL hostname verification is not enforced for the support‑agreement download (SEC-279). This is the concrete vulnerability described across multiple connected records. The available documents do not provide exploit details, impact specifics ...

CVE-2017-18407

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

CVE-2017-18398

The CVE-2017-18398 entry refers to cPanel's DnsUtils prior to version 68.0.15, where zone creation is possible for hostname and account subdomains (SEC-331). This is documented across multiple connected sources (RH/CVE, NVD, CNVD/CNVD-2019-36129) indicating a vulnerability in the DNS management u...

Malicious Package

serilize is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

mogodb-core is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

import-mysql is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

body-parse-xml is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

js-regular is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

python27:2.7 bug fix update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Bug Fixes:...

python3 bug fix update

An update is available for python3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Bug Fixes: urlsplit doesn't accept a NFKD hostname with a port number BZ17147...

nodejs: Hostname spoofing in URL parser for javascript protocol

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" e.g. "javAscript:" protoc...

CVE-2018-20852

Removed by vendor...

CVE-2019-13280

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can b...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

WordPress Server Status by Hostname/IP plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Server Status by Hostname/IP plugin is used in one of the server monitoring plugin. A SQL injection vulnerability exists in version 4.6...

CVE-2017-8411

CVE-2017-8411 affects D-Link DCS-1130 devices. A command-injection path exists via a POST parameter that can be processed by a vulnerable system API, enabling execution of arbitrary commands. Investigations point to libmailutils.so, where a vulnerable function sub_1FC4 receives POST data; the val...

Hostname-based Context Keyed Payload Encoder

Context-Keyed Payload Encoder based on hostname and x64 XOR encoder. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hostname-based Context Keyed Payload Encoder', 'Description' = 'Context-Keye...