CVE-2017-18383

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

Code injection

cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...

Design/Logic Flaw

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

CVE-2017-18390

cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...

CVE-2017-18390

CVE-2017-18390 affects cPanel prior to 68.0.15. It enables code execution in the root context due to weak permissions on incremental backups (SEC-322). The vulnerability is documented as high-severity with local access requirements. Remediation: upgrade to 68.0.15 or later. Exploitation details a...

CVE-2018-20940

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups SEC-342...

CVE-2018-20939

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

Code injection

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20940

CVE-2018-20940 affects cPanel prior to 68.0.27. The (local) vulnerability allows an attacker to read the root user’s crontab file for a brief window when backups are enabled. Exploitation details are not provided in the connected documents, and there is no explicit remediation or patch informatio...

CVE-2018-20939

CVE-2018-20939 affects cPanel prior to 68.0.27 and causes information disclosure by enabling a user to discover contents of directories not owned by that user through backups. The root cause is an improper handling of backups that exposes directory listings, enabling partial confidentiality loss ...

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

Code injection

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20909

CVE-2018-20909 affects cPanel prior to 70.0.23, where arbitrary file-chmod operations can occur during legacy incremental backups (SEC-338). Multiple sources (NVD, Red Hat advisory, CNVD) confirm the issue and link it to cPanel’s backup handling. The vulnerability arises in the backup process, en...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

Sql injection

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

Security Bulletin: IBM LMS On Premise - IBM SDK, Java Technology Edition Apr 2018 and Jul 2018 (CVE-2018-2783, CVE-2018-1517 , CVE-2018-2952)

Summary We have identified one or more security vulnerabilities that affect IBM Kenexa LMS for our on Premise customers. The Fix for these vulnerabilities is included in LMS version 6.1 only. IBM recommends updating to the latest release and following the instructions below to apply the needed fi...

Prima FlexAir Database Configuration Backup Download Vulnerability

Prima Systems FlexAir is an access control system from Prima Systems in Slovenia. A database configuration backup download vulnerability exists in Prima FlexAir version 2.3.38 and earlier. The vulnerability stems from a predictable file name. An attacker could exploit the vulnerability to downloa...