Template Injection

cron-utils is vulnerable to a template Injection vulnerability. The use of cron-utils with @Cron annotation allows an attacker to inject malicious Java EL expressions as it does not properly validate the untrusted Cron expressions, leading to a remote code execution...

MGASA-2020-0446 Updated xdg-utils package fixes a security vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information CVE-2020-27748...

Updated xdg-utils package fixes a security vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information CVE-2020-27748...

Ubuntu: Security Advisory (USN-4649-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4649-1: xdg-utils vulnerability

Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : xdg-utils vulnerability (USN-4649-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4649-1 advisory. Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive...

CVE-2020-26238

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

Design/Logic Flaw

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

CVE-2020-26238 Critical vulnerability found in cron-utils

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

Template injection in cron-utils

Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...

GHSA-PFJ3-56HM-JWQ5 Template injection in cron-utils

Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...

PT-2020-16799

Name of the Vulnerable Software and Affected Versions xdg-utils versions 1.1.0-rc1 and newer Description A flaw was found in the xdg-email component. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could...

CVE-2020-26238: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

PT-2020-16366

Name of the Vulnerable Software and Affected Versions cron-utils versions prior to 9.1.3 Description A template injection vulnerability is present in cron-utils, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. This...

Fedora 32 : cifs-utils (2020-cfdd73f1b4)

New upstream release : - fixes CVE-2020-14342 cifs-utils: shell command injection in mount.cifs - adds smb2-quota tool - adds mount.smb3 as a symlink to mount.cifs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 33 : cifs-utils (2020-ea0b9caac3)

New upstream release : - fixes CVE-2020-14342 cifs-utils: shell command injection in mount.cifs - adds smb2-quota tool - adds mount.smb3 as a symlink to mount.cifs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

3nit-utils (0.24.0), @8base/api-cli (>=0.0.1, <=0.1.0) +346 more potentially affected by CVE-2020-7769 via nodemailer (>=6.0.0, <=6.4.15)

nodemailer NPM version =6.0.0, =0.0.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.7, =1.16.0, =1.16.0, =1.16.0, =1.16.1, =1.2.1, =0.16.9, =0.17.0 - @agnostack/sync-moltin-to-shipstation 1.0.0 and more Source cves: CVE-2020-7769 Source advisory: SNYK:JS-NODEMAILER-1038834...