CVE-2019-10138

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Source: CVE-2019-10138

CVE-2019-11202

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.

Source: CVE-2019-11202

CVE-2019-10129

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).

Source: CVE-2019-10129

CVE-2019-14410

Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

Source: CVE-2019-14410

CVE-2019-14412

Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

Source: CVE-2019-14412

CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

Source: CVE-2019-14413

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

Source: CVE-2019-14411

CVE-2019-14409

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

Source: CVE-2019-14409

CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

Source: CVE-2019-14414

CVE-2018-20870

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

Source: CVE-2018-20870