110 matches found
CVE-2018-10465
CVE-2018-10465 affects Jamf Pro 10.x before 10.3.0, where users with login access had full CRUD rights to the Universal API (UAPI) endpoints, regardless of privileges. Root cause: Incorrect Access Control allowing unauthorized information disclosure, compromised data integrity, and potential data...
CVE-2018-10465
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
CVE-2018-10465: Undefined Security Weakness
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
PT-2020-8514
Name of the Vulnerable Software and Affected Versions: Jamf Pro versions prior to 10.3.0 Description: The issue concerns incorrect access control, where Jamf Pro user accounts and groups with login access to Jamf Pro have full access to endpoints in the Universal API UAPI, regardless of their...
CVE-2019-14411
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
CVE-2019-14410
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
Design/Logic Flaw
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
Format string
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
Format string
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
CVE-2019-14412
CVE-2019-14412 affects cPanel before 78.0.2, where the Maketext function can perform a format-string injection via the DCV domain validation via DNS UAPI (SEC-474). The underlying issue is a formatting string handling flaw in Maketext, enabling injection within the DCV check_domains_via_dns UAPI....
CVE-2019-14411
CVE-2019-14411 affects cPanel prior to 78.0.2. The vulnerability arises because the DCV UAPI does not properly restrict demo accounts from writing to files, enabling an attacker to write to files via the DCV UAPI (SEC-473). Impact is implicit in the description: unauthorized file writes by demo a...
CVE-2019-14411
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
CVE-2019-14412: Use of Externally-Controlled Format String
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
PT-2019-13680
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 78.0.2 Description The issue is related to demo accounts having improper restrictions, allowing them to write to files via the DCV UAPI. Recommendations For versions prior to 78.0.2, update to version 78.0.2 or later t...
PT-2019-13679
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 78.0.2 Description The issue allows format-string injection in the Email store filter UAPI. Recommendations For versions prior to 78.0.2, update to version 78.0.2 or later to resolve the issue...
CVE-2019-14411: Undefined Security Weakness
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
PT-2019-13681
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 78.0.2 Description The issue allows format-string injection in the DCV check domains via dns UAPI. Recommendations For versions prior to 78.0.2, update to version 78.0.2 or later to resolve the issue...