CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

Webuzo 跨站脚本漏洞

Webuzo is a powerful and easy-to-use web hosting control panel from Webuzo Inc. It allows hosting providers and users to automate server administration tasks while providing customers with the tools they need to manage their sites. Webuzo suffers from a cross-site scripting vulnerability that can...

Privilege Escalation

systemd-cron:sid is vulnerable to privilege escalation. In the cron package, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

Code injection

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27557

The CVE-2021-27557 entry describes a CSRF vulnerability in the Cron job tab of EasyCorp ZenTao 12.5.3, allowing an attacker to update fields of a Cron job. The issue is confirmed across multiple sources (NVD, Red Hat, OSV) as a CSRF flaw in ZenTao 12.5.3. The root cause is cross-site request forg...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27556

CVE-2021-27556 concerns EasyCorp ZenTao 12.5.3, where the Cron job tab can be abused by an admin to set the type parameter to System and execute arbitrary code. The underlying issue is a parameter handling flaw in the Cron tab that enables remote code execution. Documents consistently describe co...

Nature Easy Soft Network Technology ZenTao 跨站请求伪造漏洞

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes features such as product management, project management, quality management and document...

Nature Easy Soft Network Technology ZenTao 操作系统命令注入漏洞

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions...

cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

CVE-2020-21786

In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php...

The vulnerability of the cron/cmd_subsys.php implementation of the software for monitoring IT infrastructure by Nagios Fusion allows a perpetrator to escalate their privileges.

The vulnerability of the cron/cmdsubsys.php implementation of the Nagios Fusion IT infrastructure monitoring software is related to insufficient cleaning of input data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...