2019

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).

cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging

cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of bac

cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archi

cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).

cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).

Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of p

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).

Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. An

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A m

Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an a

OX App Suite 7.10.1 and earlier has Insecure Permissions.

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rath

An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.

Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker

In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE and android.net.wifi.S

In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to

In keyguard, there is a possible escalation of privilege due to improper permission checks. This could lead to a local b

In the Activity Manager service, there is a possible information disclosure due to a confused deputy. This could lead to

In SyncStatusObserver, there is a possible bypass for operating system protections that isolate user profiles from each

In AudioService, there is a possible trigger of background user audio due to a permissions bypass. This could lead to lo

In FingerprintService, there is a possible bypass for operating system protections that isolate user profiles from each

In the Package Manager service, there is a possible information disclosure due to a confused deputy. This could lead to

In AOSP Email, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure

IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on

Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can

ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce

ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does

atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforc

base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not

llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce

In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap

In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-base

libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_locati

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins m

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a l

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive informat

ruby193 uses an insecure LD_LIBRARY_PATH setting.

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.

Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server

liboping 1.3.2 allows users reading arbitrary files upon the local system.