cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).

cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).

cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).

cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).

cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).

cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).

cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).

cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).

cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).

cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).

cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).

An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.

manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.