CVE-2023-4677

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

Design/Logic Flaw

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

CVE-2023-4677 Unauthenticated Admin Account Takeover Via Cron Log File Backups

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

CVE-2023-4677 Unauthenticated Admin Account Takeover Via Cron Log File Backups

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

CVE-2023-4677

CVSS : 9.8 (CRITICAL) for Pandora FMS Console

PT-2023-8542 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions = 772 Description: The issue is related to insufficient protection of registration data in the Pandora FMS Console, allowing an attacker to gain unauthorized access to protected information and elevate their privileges to...

CVE-2023-40361

SECUDOS Qiata DOMOS OS 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user...

man-db: privilege escalation

Background man-db is a man replacement that utilizes BerkeleyDB instead of flat files. Description A root privilege escalation through setuid executable and cron job has been discovered in man-db. Please review the CVE identifier referenced below for details. Impact A local user with access to th...

CVE-2023-27121

A cross-site scripting XSS vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter...

CVE-2023-27121

A cross-site scripting XSS vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter...

CVE-2023-27121

A cross-site scripting XSS vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter...

Pleasant Solutions Pleasant Password Server Cross-Site Scripting Vulnerability

Pleasant Solutions Pleasant Password Server is a proprietary multi-user enterprise password server from Pleasant Solutions. A security vulnerability exists in Pleasant Solutions Pleasant Password Server version v7.11.41.0, which originates from a cross-site scripting XSS vulnerability in the...

Openmediavault < 0.5.32 Privilege Escalation Vulnerability

Openmediavault is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-43309

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

CVE-2023-43309

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

CVE-2023-43309

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

Cross site scripting

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

CVE-2023-43309

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

Webmin Cross-Site Scripting Vulnerability

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin 2.002 and prior versions that stems from a stored cross-site scripting XSS vulnerability in the Input field of the Cluster Cron Job...

PT-2023-9415 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin versions 2.002 and below Description: The issue is related to a stored cross-site scripting XSS vulnerability, which allows attackers to run malicious scripts by injecting a specially crafted payload via the Cluster Cron Job tab Input...