Code injection

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20940

CVE-2018-20940 affects cPanel prior to 68.0.27. The (local) vulnerability allows an attacker to read the root user’s crontab file for a brief window when backups are enabled. Exploitation details are not provided in the connected documents, and there is no explicit remediation or patch informatio...

CVE-2018-20939

CVE-2018-20939 affects cPanel prior to 68.0.27 and causes information disclosure by enabling a user to discover contents of directories not owned by that user through backups. The root cause is an improper handling of backups that exposes directory listings, enabling partial confidentiality loss ...

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20909

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

Code injection

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20909

CVE-2018-20909 affects cPanel prior to 70.0.23, where arbitrary file-chmod operations can occur during legacy incremental backups (SEC-338). Multiple sources (NVD, Red Hat advisory, CNVD) confirm the issue and link it to cPanel’s backup handling. The vulnerability arises in the backup process, en...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

Sql injection

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

PT-2019-10316

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 74.0.0 Description: The issue allows SQL injection during database backups. Recommendations: For versions prior to 74.0.0, update to version 74.0.0 or later to resolve the issue...

PT-2019-10340

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows for arbitrary file-chmod operations during legacy incremental backups. Recommendations: For versions prior to 70.0.23, update to version 70.0.23 or later to resolve the issue...

PT-2019-10373

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 68.0.27 Description: The issue allows a user to discover contents of directories that are not owned by that user by leveraging backups. Recommendations: For versions prior to 68.0.27, update to version 68.0.27 or late...

PT-2019-10375

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 68.0.27 Description: The issue allows attackers to read the root's crontab file during a short time interval when backups are enabled. Recommendations: For versions prior to 68.0.27, update to version 68.0.27 or later...

CVE-2018-20939: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 68.0.27 allows a user to discover contents of directories that are not owned by that user by leveraging backups SEC-339...

CVE-2018-20940: Concurrent Execution using Shared Resource with Improper Synchronization

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups SEC-342...

CVE-2018-20909: Incorrect Permission Assignment for Critical Resource

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...

CVE-2018-20887: Improper Neutralization of Special Elements used in an SQL Command

cPanel before 74.0.0 allows SQL injection during database backups SEC-420...

Security Bulletin: IBM LMS On Premise - IBM SDK, Java Technology Edition Apr 2018 and Jul 2018 (CVE-2018-2783, CVE-2018-1517 , CVE-2018-2952)

Summary We have identified one or more security vulnerabilities that affect IBM Kenexa LMS for our on Premise customers. The Fix for these vulnerabilities is included in LMS version 6.1 only. IBM recommends updating to the latest release and following the instructions below to apply the needed fi...