Security Vulnerabilities - CVEs Published In August 2019
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
CVSS Score
5.4
EPSS Score
0.003
Published
2019-08-06
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
CVSS Score
5.4
EPSS Score
0.003
Published
2019-08-06
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
CVSS Score
6.5
EPSS Score
0.003
Published
2019-08-06
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
CVSS Score
6.5
EPSS Score
0.003
Published
2019-08-06
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
CVSS Score
8.1
EPSS Score
0.003
Published
2019-08-06
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
CVSS Score
5.4
EPSS Score
0.002
Published
2019-08-05
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
CVSS Score
5.4
EPSS Score
0.002
Published
2019-08-05
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
CVSS Score
3.3
EPSS Score
0.001
Published
2019-08-05
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
CVSS Score
5.4
EPSS Score
0.002
Published
2019-08-05
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.
CVSS Score
7.5
EPSS Score
0.004
Published
2019-08-05