CVE-2023-48087

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...

CVE-2023-48089

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...

CVE-2023-48089

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...

CVE-2023-48087

CVE-2023-48087 affects xxl-job-admin version 2.4.0. The vulnerability stems from insecure permissions / privilege mismanagement on the API endpoints /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat, potentially leading to disclosure of sensitive information. Publicly document...

PT-2023-30695 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...

CVE-2023-48089

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...

PT-2023-30694 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue is related to Cross Site Scripting XSS that can be exploited via the "/xxl-job-admin/joblog/logDetailPage" API endpoint. This allows for potential malicious script injection. Recommendations:...

CVE-2023-48088

xxl-job-admin 2.4.0 is documented as vulnerable to Cross Site Scripting (XSS) via the /xxl-job-admin/joblog/logDetailPage endpoint. The issue affects the xxl-job-admin component and is described consistently across multiple feeds. The root cause is an XSS vulnerability in that API page/endpoint, ...

CVE-2023-48087

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...

CVE-2023-48087

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...

CVE-2023-48088

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting XSS via /xxl-job-admin/joblog/logDetailPage...

CVE-2023-48089

XXL-JOB-ADMIN 2.4.0 is affected by a Remote Code Execution (RCE) vulnerability exploitable via the /xxl-job-admin/jobcode/save endpoint. The connected PT-2023-30695 entry confirms the affected version and the API path involved, describing the issue as an RCE. No explicit root-cause or CVE technic...

CVE-2023-48087

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...

GHSA-47XW-VW6M-W9FQ HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

Vagrant Security Vulnerabilities

Vagrant is a command line utility for managing the lifecycle of virtual machines. Isolates dependencies and their configurations in a single disposable and consistent environment. A security vulnerability exists in HashiCorp Vagrant versions prior to 2.4.0 that stems from the presence of...

GHSA-9QQG-MH7C-CHFQ Apache Airflow vulnerable to Exposure of Sensitive Information

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow. This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for...

PT-2023-8382 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.4.0 through 2.7.0 Description: The issue is related to the exposure of sensitive information in Apache Airflow, which could allow a remote attacker to obtain confidential information. Recommendations: For Apache...

AZL-34837 CVE-2023-44487 affecting package keda for versions less than 2.4.0-14

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-40559

Cross-Site Request Forgery CSRF vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin = 2.4.0 versions...

Security Bulletin: Multiple vulnerabilities in ivy-2.4.0.jar affect IBM Application Performance Management products

Summary There are multiple vulnerabilities in ivy-2.4.0.jar used by IBM Application Performance Management. IBM Application Performance Management has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-37865 DESCRIPTION: Apache Ivy could allow a local authenticated attacker to...