1926 matches found
Design/Logic Flaw
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface SEC-526...
CVE-2019-17380
CVE-2019-17380 affects cPanel's WHM Update Preferences interface, where versions prior to 82.0.15 are vulnerable to a self‑XSS due to lack of proper validation of client‑side data. The issue arises within the WHM Update Preferences UI and can lead to execution of client‑side code, as described ac...
CVE-2019-17379
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface SEC-527...
CVE-2019-17378
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface SEC-526...
CVE-2019-17376
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface SEC-521...
CVE-2019-17376
CVE-2019-17376 affects cPanel prior to 82.0.15, where the SSL Certificate Upload interface is vulnerable to self-XSS due to insufficient validation in client-side data handling. Multiple sources confirm the flaw exists in the SSL Certificate Upload feature and is tied to versions older than 82.0....
CVE-2019-17380: Improper Neutralization of Input During Web Page Generation
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface SEC-528...
CVE-2019-17376: Improper Neutralization of Input During Web Page Generation
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface SEC-521...
CVE-2019-17377: Improper Neutralization of Input During Web Page Generation
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts SEC-524...
LimeSurvey 3.17.13 - Cross-Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored and reflected XSS vulnerabilities product: LimeSurvey vulnerable version: 3.17.14 CVE number: CVE-2019-16172, CVE-2019-16173 impact: medium homepage:...
Zyxel Gateway / Access Point External DNS Request Vulnerability
Some Zyxel Access Points are prone to an information disclosure vulnerability where external DNS requests can be made. This VT has been deprecated and replaced by various device specific VTs. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced...
Message Signature Bypass
Overview Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input such as...
SEC Investigating Data Leak at First American Financial Corp.
The U.S. Securities and Exchange Commission SEC is investigating a security failure on the Web site of real estate title insurance giant First American Financial Corp. that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has...
CVE-2016-10804
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore SEC-58...
CVE-2016-10810
In cPanel before 57.9999.54, /scripts/maildirconverter exposed a TTY to an unprivileged process SEC-115...
CVE-2016-10805
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...
Design/Logic Flaw
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process SEC-114...
Code injection
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs SEC-113...