Debian DLA-2801-1 : cron - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2801 advisory. - In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root...

DLA-2801-1 cron - security update

Bulletin has no description...

LinuxCatScale - Incident Response Collection And Processing Scripts With Automated Reporting Scripts

Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process. Usage This script...

VMware vCenter Server Analytics (CEIP) Service File Upload Exploit

This Metasploit module exploits a file upload in VMware vCenter Server's analytics/telemetry CEIP service to write a system crontab and execute shell commands as the root user. Note that CEIP must be enabled for the target to be exploitable by this module. CEIP is enabled by default. This module...

CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

Webuzo 跨站脚本漏洞

Webuzo is a powerful and easy-to-use web hosting control panel from Webuzo Inc. It allows hosting providers and users to automate server administration tasks while providing customers with the tools they need to manage their sites. Webuzo suffers from a cross-site scripting vulnerability that can...

Privilege Escalation

systemd-cron:sid is vulnerable to privilege escalation. In the cron package, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

Code injection

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27557

A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...

CVE-2021-27557

The CVE-2021-27557 entry describes a CSRF vulnerability in the Cron job tab of EasyCorp ZenTao 12.5.3, allowing an attacker to update fields of a Cron job. The issue is confirmed across multiple sources (NVD, Red Hat, OSV) as a CSRF flaw in ZenTao 12.5.3. The root cause is cross-site request forg...

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...

CVE-2021-27556

CVE-2021-27556 concerns EasyCorp ZenTao 12.5.3, where the Cron job tab can be abused by an admin to set the type parameter to System and execute arbitrary code. The underlying issue is a parameter handling flaw in the Cron tab that enables remote code execution. Documents consistently describe co...

Nature Easy Soft Network Technology ZenTao 操作系统命令注入漏洞

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions...