|
219471
|
9.8 |
CRITICAL
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
|
NVD-CWE-noinfo
|
CVE-2019-20498
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219472
|
5.4 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
|
CWE-79
Cross-site Scripting
|
CVE-2019-20497
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219473
|
5.5 |
MEDIUM
Local
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
|
NVD-CWE-noinfo
|
CVE-2019-20496
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219474
|
6.5 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
|
NVD-CWE-noinfo
|
CVE-2019-20495
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219475
|
3.3 |
LOW
Local
|
cpanel
|
cpanel
|
In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
|
CWE-330
Use of Insufficiently Random Values
|
CVE-2019-20494
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219476
|
6.1 |
MEDIUM
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
|
CWE-79
Cross-site Scripting
|
CVE-2019-20493
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219477
|
8.8 |
HIGH
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
|
NVD-CWE-noinfo
|
CVE-2019-20492
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219478
|
8.8 |
HIGH
Network
|
cpanel
|
cpanel
|
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
|
NVD-CWE-noinfo
|
CVE-2019-20490
|
2024-11-21 13:38 |
2020-03-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219479
|
8.8 |
HIGH
Network
|
pydio
|
pydio
|
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basi…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2019-20453
|
2024-11-21 13:38 |
2020-03-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219480
|
8.8 |
HIGH
Network
|
pydio
|
pydio
|
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user wi…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2019-20452
|
2024-11-21 13:38 |
2020-03-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|