Webmin 跨站脚本漏洞

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. version 1.973 of Webmin contains a cross-site scripting vulnerability that stems from a lack of filtering and escaping in the scheduled Cron jobs feature. An attacker could use this...

The vulnerability in the implementation of the cron/save_allow.cgi script of the Scheduled Cron Jobs web interface for system administration on UNIX-like operating systems like Webmin allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cron/saveallow.cgi implementation in the Scheduled Cron Jobs web interface for system administration on UNIX-like operating systems, such as Webmin, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to gain...

cron-utils: template Injection leading to unauthenticated Remote Code Execution

A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution RCE via Java Expression Language EL injection...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update

A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System...

CVE-2022-27226

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

iRZ Mobile Routers 跨站请求伪造漏洞

iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in /api/crontab of iRZ Mobile Routers, which can be exploited by an attacker to create a crontab entry in the router's administration panel, which will be executed by a cronjob at an...

USN-5334-1 man-db vulnerability

It was discovered that man-db incorrectly handled permission changing operations in its daily cron job, and was therefore affected by a race condition. An attacker could possibly use this issue to escalate privileges and execute arbitrary code...

OPENSUSE-SU-2022:0081-1 Security update for ansible

Ansible was updated to 2.9.21 to fix lots of bugs and security issues. Update to version 2.9.20, maintenance release containing numerous bugfixes. Update to version 2.9.19 with minor changes and a few bug fixes. Update to version 2.9.18: CVE-2021-20228 where default and fallback values for nolog...

Webmin authorization issue vulnerability

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

Webmin 授权问题漏洞

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

WordPress WP-Cron Status Checker plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP-Cron Status Checker plugin versions = 1.2.2. Solution Update the WordPress WP-Cron Status Checker plugin to the latest available version at least 1.2.4...

WordPress WP-Cron Status Checker plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP-Cron Status Checker plugin versions = 1.2.2. Solution Update the WordPress WP-Cron Status Checker plugin to the latest available version at least 1.2.4...

CVE-2022-24986

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands...

DEBIAN-CVE-2022-24986

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands...

UBUNTU-CVE-2022-24986

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands...

PT-2022-17033 · Kde +2 · Kde Kcron +2

Name of the Vulnerable Software and Affected Versions: KDE KCron versions prior to 21.12.3 Description: The issue allows an attacker to potentially intercept a temporary file and run unauthorized commands. This is due to the reuse of a filename in the /tmp directory during an editing session...

cron-utils: template Injection leading to unauthenticated Remote Code Execution

A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution RCE via Java Expression Language EL injection...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.2.5 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

Improper Authorization in webmin/webmin

Description The /cron/saveallow.cgi endpoint is accessible to any authenticated low privilege users resulting in controlling user access to cron jobs. They could allow and deny other users access to cron jobs affecting the Scheduled Cron Jobs module. Proof of Concept Affected Endpoint: GET...

Nagios XI Autodiscovery Shell Upload Exploit

This Metasploit module exploits a path traversal issue in Nagios XI before version 5.8.5. The path traversal allows a remote and authenticated administrator to upload a PHP web shell and execute code as www-data. The module achieves this by creating an autodiscovery job with an id field containin...