Cross site scripting

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature...

CVE-2021-32157

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature...

CVE-2021-32156

A cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature...

CVE-2021-32157

Webmin 1.973 contains a Cross-Site Scripting (XSS) vulnerability via the Scheduled Cron Jobs feature. The issue arises from insufficient filtering/escaping in that feature, enabling client-side JavaScript execution. Connected sources confirm CVE-2021-32157 and corroborating mentions in RH and OSV...

CVE-2021-32156

CVE-2021-32156 affects Webmin 1.973 via the Scheduled Cron Jobs feature. Root cause: CSRF due to lack of token validation in the Cron/scheduled task handling. Impact: allows cross-site requests that could perform sensitive actions; CVSS v3.1 base score 8.8 (HIGH) with UI/Risk requiring user inter...

Webmin 跨站请求伪造漏洞

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.Webmin version 1.973 is vulnerable to cross-site request forgery, which stems from the lack of token validation for cross-site request forgery in the scheduled Cron job function. An...

Webmin 跨站脚本漏洞

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. version 1.973 of Webmin contains a cross-site scripting vulnerability that stems from a lack of filtering and escaping in the scheduled Cron jobs feature. An attacker could use this...

The vulnerability in the implementation of the cron/save_allow.cgi script of the Scheduled Cron Jobs web interface for system administration on UNIX-like operating systems like Webmin allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cron/saveallow.cgi implementation in the Scheduled Cron Jobs web interface for system administration on UNIX-like operating systems, such as Webmin, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to gain...

cron-utils: template Injection leading to unauthenticated Remote Code Execution

A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution RCE via Java Expression Language EL injection...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update

A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System...

CVE-2022-27226

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

iRZ Mobile Routers 跨站请求伪造漏洞

iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in /api/crontab of iRZ Mobile Routers, which can be exploited by an attacker to create a crontab entry in the router's administration panel, which will be executed by a cronjob at an...

USN-5334-1 man-db vulnerability

It was discovered that man-db incorrectly handled permission changing operations in its daily cron job, and was therefore affected by a race condition. An attacker could possibly use this issue to escalate privileges and execute arbitrary code...

OPENSUSE-SU-2022:0081-1 Security update for ansible

Ansible was updated to 2.9.21 to fix lots of bugs and security issues. Update to version 2.9.20, maintenance release containing numerous bugfixes. Update to version 2.9.19 with minor changes and a few bug fixes. Update to version 2.9.18: CVE-2021-20228 where default and fallback values for nolog...

Webmin authorization issue vulnerability

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

Webmin 授权问题漏洞

Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. an authorization issue vulnerability exists in versions of Webmin prior to 1.990, which stems from a lack of authentication measures or insufficient authentication strength in a networked...

WordPress WP-Cron Status Checker plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP-Cron Status Checker plugin versions = 1.2.2. Solution Update the WordPress WP-Cron Status Checker plugin to the latest available version at least 1.2.4...

WordPress WP-Cron Status Checker plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP-Cron Status Checker plugin versions = 1.2.2. Solution Update the WordPress WP-Cron Status Checker plugin to the latest available version at least 1.2.4...

CVE-2022-24986

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands...

DEBIAN-CVE-2022-24986

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands...