ZesleCP 3.1.20 Privilege Escalation

ZesleCP version 3.1.20 remote privilege escalation exploit that leverages cron to achieve root level privileges. Exploit Title: ZesleCP v3.1.20 - Privilege Escalation Exploit Author: Ahmet Ümit BAYRAM Date: 09.11.2024 Vendor Homepage: https://zeslecp.com Tested on: Ubuntu 20.04 Privilege Escalati...

Linux Distros Unpatched Vulnerability : CVE-2017-9525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root...

Linux Distros Unpatched Vulnerability : CVE-2019-9704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service daemon crash via a large crontab file because the calloc return...

Linux Distros Unpatched Vulnerability : CVE-2019-9705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service memory consumption via a large crontab file because an unlimited...

RaspberryMatic 3.73.9.20240130 Remote Code Execution Exploit

RaspberryMatic / OCCU contains a unauthenticated remote code execution vulnerability, caused by multiple issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached through the URL /pages/jpages/system/DeviceFirmware/addFirmware. This allows a...

CVE-2025-25195

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

CVE-2025-25195

Zulip vulnerability CVE-2025-25195 involves a logic flaw in the weekly cron job that demotes channels to “inactive” after 180 days. When a private channel is demoted, an event revealing the private channel name is accidentally broadcast to all users in the organization, and the system also leaks ...

CVE-2022-48685

An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file cleansecbioldlogs is writable by all users and is executed as root, leading to privilege escalation...

cron-utils:CronParserFuzzer: Security exception in java.base/java.util.Arrays.copyOf

Detailed Report: https://oss-fuzz.com/testcase?key=5103060199735296 Project: cron-utils Fuzzing Engine: libFuzzer Fuzz Target: CronParserFuzzer Job Type: libfuzzerasancron-utils Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.copyOf...

CVE-2024-9461

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the croninterval parameter. This is due to missing input validation and sanitization. This makes it possible f...

PT-2024-39649 · WordPress · Total Upkeep

Name of the Vulnerable Software and Affected Versions: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate versions up to 1.16.6 Description: The issue is related to the lack of input validation and sanitization, making it possible for authenticated attackers with Administrator-level...

Exploit for Uncontrolled Search Path Element in Needrestart_Project Needrestart

CVE-2024-48990 Exploit My full writeup for how I came to re-...

WordPress Database Scanning For Malware Released in Wordfence CLI 5.0.1

Today we’re excited to announce the recent release of Wordfence CLI version 5.0.1 which includes a much requested feature from security analysts, hosting providers and ops teams: Database scanning for WordPress. Now you can scan any WordPress database you have access to for malware and...

New CRON#TRAP Malware Infects Windows by Hiding in Linux VM to Evade Antivirus

Cybersecurity researchers have flagged a new malware campaign that infects Windows systems with a Linux virtual instance containing a backdoor capable of establishing remote access to the compromised hosts. The "intriguing" campaign, codenamed CRONTRAP , starts with a malicious Windows shortcut L...

Hackers Deploy CRON#TRAP for Persistent Linux System Backdoors

CRONTRAP is a new phishing attack using emulated Linux environments to bypass security and establish persistent backdoors. Leveraging…...

CVE-2024-43154

Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9...

CVE-2024-43154

Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9...

CVE-2024-43154 WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9...

CVE-2024-43154 WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9...

CVE-2024-43154

CVE-2024-43154 is a Missing Authorization (broken access control) vulnerability in BracketSpace Advanced Cron Manager for WordPress, affecting debug & control up to version 2.5.9. Public sources indicate this plugin allows unauthorized access due to misconfigured access controls. Remediation from...