CVE-2020-10116

CVE-2020-10116 affects cPanel prior to 84.0.20. An attacker can bypass restrictions on features and demo accounts via WebDisk UAPI calls, enabling a restriction-bypass condition (SEC-541). The issue is tied to versions before 84.0.20; upgrade to 84.0.20 or later to remediate.

CVE-2018-10465

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

Information disclosure

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

CVE-2018-10465

CVE-2018-10465 affects Jamf Pro 10.x before 10.3.0, where users with login access had full CRUD rights to the Universal API (UAPI) endpoints, regardless of privileges. Root cause: Incorrect Access Control allowing unauthorized information disclosure, compromised data integrity, and potential data...

CVE-2018-10465

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

CVE-2019-14410

Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...

CVE-2019-14412

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...

Design/Logic Flaw

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

Format string

Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...

Format string

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...

CVE-2019-14412

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...

CVE-2019-14412

CVE-2019-14412 affects cPanel before 78.0.2, where the Maketext function can perform a format-string injection via the DCV domain validation via DNS UAPI (SEC-474). The underlying issue is a formatting string handling flaw in Maketext, enabling injection within the DCV check_domains_via_dns UAPI....

CVE-2019-14411

CVE-2019-14411 affects cPanel prior to 78.0.2. The vulnerability arises because the DCV UAPI does not properly restrict demo accounts from writing to files, enabling an attacker to write to files via the DCV UAPI (SEC-473). Impact is implicit in the description: unauthorized file writes by demo a...

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS. The vulnerability exists as there was an error in the uAPI interface...

Geutebruck simple_loglistjs.cgi Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geutebruck simpleloglistjs.cgi Remote Command Execution', 'Description' = %q This module exploits a an arbitrary command execution vulnerability...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-753)

The openSUSE Leap 42.1 kernel was updated to 4.1.26 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils wa...

CVE-2016-4565

The InfiniBand aka IB stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service kernel memory write operation or possibly have unspecified other impact via a uAPI interface...

Design/Logic Flaw

The InfiniBand aka IB stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service kernel memory write operation or possibly have unspecified other impact via a uAPI interface...