Security Vulnerabilities - CVEs Published In August 2019
cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
CVSS Score
7.8
EPSS Score
0.002
Published
2019-08-02
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
CVSS Score
2.7
EPSS Score
0.003
Published
2019-08-02
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
CVSS Score
5.4
EPSS Score
0.003
Published
2019-08-02
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
CVSS Score
7.8
EPSS Score
0.0
Published
2019-08-02
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
CVSS Score
8.8
EPSS Score
0.0
Published
2019-08-02
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-08-02
A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened.
CVSS Score
7.8
EPSS Score
0.007
Published
2019-08-02
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
CVSS Score
2.7
EPSS Score
0.003
Published
2019-08-02
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
CVSS Score
7.8
EPSS Score
0.001
Published
2019-08-02
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
CVSS Score
3.8
EPSS Score
0.001
Published
2019-08-02