Design/Logic Flaw

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2020-10121

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs SEC-546...

CVE-2020-10120

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

CVE-2020-10119

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...

CVE-2020-10118

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...

CVE-2020-10117

CVE-2020-10117 affects cPanel prior to 84.0.20, where enforcement of demo checks in the Market UAPI namespace is mishandled (SEC-542). The issue enables weaknesses in access/validation that could impact confidentiality and integrity (per CVSS3.1: High, with Network access and no user interaction)...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20498

CVE-2019-20498 affects cPanel prior to 82.0.18. The issue is a WebDAV authentication bypass caused by incorrect connection-sharing logic (SEC-534). Reported across multiple feeds, the vulnerability explicitly impacts WebDAV authentication. Affected component: cPanel WebDAV handling; root cause: f...

CVE-2019-20495

CVE-2019-20495 affects cPanel; prior to version 82.0.18, an attacker can read an arbitrary database via a MySQL dump stream. Impact is partial confidentiality breach (read access). Remediation: upgrade to 82.0.18 or newer. Exploitation status not provided in the documents.

CVE-2019-20494

In cPanel before 82.0.18, the RNG function Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Affected product: cPanel (web hosting control panel). Vulnerable component: Cpanel::Rand::Get. Root cause: RNG predictability leads to low-entropy sequences. Impact: potential infor...

CVE-2019-20493

CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...

CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

CVE-2019-20492

CVE-2019-20492 affects cPanel

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently SEC-499...

CVE-2019-20491

CVE-2019-20491 concerns cPanel prior to 82.0.18 where an attacker can leverage virtual mail accounts to bypass account suspensions (SEC-508). This is the explicit vulnerability described in multiple sources. The linked Red Hat/CNVD/etc. entries corroborate the same issue. Impact is that a bypass ...

Phoenix Contact TC Router / TC Cloud Client Command Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Command Injection product: Phoenix Contact TC Router & TC Cloud Client vulnerable version: =2.05.3 & =2.03.17 & =1.03.17 fixed version: 2.05.4 & 2.03.18 &...

PHP-Fusion CMS 9.03 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-site Scripting XSS Vulnerabilities product: PHP-Fusion CMS vulnerable version: 9 - 9.03 fixed version: 9.03.30 CVE number: - impact: Medium homepage:...

WordPress RegistrationMagic plugin <= 4.6.0.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Spider Sec Ltd. in WordPress RegistrationMagic plugin versions = 4.6.0.1. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 4.6.0.3...

Wireshark Security Updates (wnpa-sec-2020-01) - Windows

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...