CVE-2024-43688

CVE-2024-43688 affects cron/entry.c in vixie cron prior to 9cc8ab1, as used in OpenBSD 7.4 and 7.5. The issue is a heap-based buffer underflow leading to memory corruption, introduced during a May 2023 refactoring. Affected products include vixie cron and OpenBSD releases 7.4/7.5; impact is memor...

CVE-2024-43688

cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring...

CVE-2024-43688

cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring...

PT-2024-30615 · Openbsd +1 · Openbsd +1

Name of the Vulnerable Software and Affected Versions: vixie cron versions prior to 9cc8ab1 OpenBSD versions 7.4 and 7.5 Description: The issue allows a heap-based buffer underflow and memory corruption in cron/entry.c. This was introduced during a May 2023 refactoring. Recommendations: For vixie...

WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Advanced Cron Manager – debug & control versions = 2.5.9...

WordPress Advanced Cron Manager – debug & control Plugin <= 2.5.9 is vulnerable to Broken Access Control

Software Advanced Cron Manager – debug & control Type Plugin Vulnerable versions = 2.5.9 Fixed in 2.5.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7331ca5ca4a8 Credits...

OpenMediaVault rpc.php Authenticated Cron Remote Code Execution Exploit

OpenMediaVault allows an authenticated user to create cron jobs as root on the system. An attacker can abuse this by sending a POST request via rpc.php to schedule and execute a cron entry that runs arbitrary commands as root on the system. All OpenMediaVault versions including the latest release...

OpenMediaVault rpc.php Authenticated Cron Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenMediaVault rpc.php Authenticated Cron Remote Code Execution', 'Description' = %q OpenMediaVault allows an authenticated user to create cron...

OpenMediaVault rpc.php Authenticated Cron Remote Code Execution

OpenMediaVault allows an authenticated user to create cron jobs as root on the system. An attacker can abuse this by sending a POST request via rpc.php to schedule and execute a cron entry that runs arbitrary commands as root on the system. All OpenMediaVault versions including the latest release...

OPENSUSE-SU-2024:10139-1 cron-4.2-65.4 on GA media

These are all security issues fixed in the cron-4.2-65.4 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10701-1 cron-4.2-86.1 on GA media

These are all security issues fixed in the cron-4.2-86.1 package on the GA media of openSUSE Tumbleweed...

RHEL 5 : cronie (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - vixie-cron: calloc return value resulting in remote dos CVE-2019-9704 Note that Nessus has not tested for this issu...

RHEL 8 : cronie (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - vixie-cron: memory consumption DoS via a large crontab file CVE-2019-9705 - Vixie Cron before the...

RHEL 4 : vixie-cron (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file CVE-2010-0424...

DRUPAL-CONTRIB-2024-024

The Migrate queue importer module enables you to create cron migrationsconfiguration entities with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an...

Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

The Migrate queue importer module enables you to create cron migrationsconfiguration entities with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an...

Fedora 39 : nextcloud (2024-80aa2e0e55)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-80aa2e0e55 advisory. Update nextcloud to 28.0.5 and PR 11 PR 11 Many issues fixed by aviram: - Better HTTPS handling in Apache configs - Better cron job compatibility with APC -...

Fedora 40 : nextcloud (2024-456a389028)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-456a389028 advisory. Update nextcloud to 28.0.5 and PR 11 PR 11 Many issues fixed by aviram: - Better HTTPS handling in Apache configs - Better cron job compatibility with APC -...

CVE-2024-1762

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTPUSERAGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-1762 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTPUSERAGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...