7760 matches found
CVE-2023-48089
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...
CVE-2023-48087
CVE-2023-48087 affects xxl-job-admin version 2.4.0. The vulnerability stems from insecure permissions / privilege mismanagement on the API endpoints /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat, potentially leading to disclosure of sensitive information. Publicly document...
CVE-2023-48087
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...
CVE-2023-48088
xxl-job-admin 2.4.0 is documented as vulnerable to Cross Site Scripting (XSS) via the /xxl-job-admin/joblog/logDetailPage endpoint. The issue affects the xxl-job-admin component and is described consistently across multiple feeds. The root cause is an XSS vulnerability in that API page/endpoint, ...
CVE-2023-48088
xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting XSS via /xxl-job-admin/joblog/logDetailPage...
CVE-2023-48088
xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting XSS via /xxl-job-admin/joblog/logDetailPage...
PT-2023-30694 · Unknown · Xxl-Job-Admin
Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue is related to Cross Site Scripting XSS that can be exploited via the "/xxl-job-admin/joblog/logDetailPage" API endpoint. This allows for potential malicious script injection. Recommendations:...
CVE-2023-48087
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...
PT-2023-30695 · Unknown · Xxl-Job-Admin
Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...
CVE-2023-48089
XXL-JOB-ADMIN 2.4.0 is affected by a Remote Code Execution (RCE) vulnerability exploitable via the /xxl-job-admin/jobcode/save endpoint. The connected PT-2023-30695 entry confirms the affected version and the API path involved, describing the issue as an RCE. No explicit root-cause or CVE technic...
CVE-2023-48089
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...
XXL-JOB Security Vulnerability
XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xue Li XXL-JOB community. A security vulnerability exists in XXL-JOB xxl-job-admin version 2.4.0, which stems from a Remote Code Execution RCE vulnerability in component /xxl-job-admin/jobcode/save...
Ray Agent Job RCE
RCE in Ray via the agent job submission endpoint. This is intended functionality as Ray's main purpose is executing arbitrary workloads. By default Ray has no authentication. Module Options msf use exploit/linux/http/ray/agentjobrce msf undefinedagentjobrce show actions ...actions... msf...
PT-2023-30693 · Unknown · Xxl-Job-Admin
Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue concerns insecure permissions in xxl-job-admin, specifically affecting the "/xxl-job-admin/joblog/clearLog" and "/xxl-job-admin/joblog/logDetailCat" API endpoints. Recommendations: For...
CVE-2023-48089
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...
CVE-2023-48087
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat...
kernel: Use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdioremove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdioremove with an unfinished job may cause a race problem which leads to a UAF on hdev devices...
Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers
A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent...
cups security and bug fix update
1:2.3.3op2-21 - bump the spec because the previous build was made with buildroot 9.2 1:2.3.3op2-20 - CVE-2023-32360 cups: Information leak through Cups-Get-Document operation 1:2.3.3op2-19 - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient in scheduler/client.c - CVE-2023-32324 cups: heap...