SUSE-SU-2021:0139-1 Security update for slurm_20_02

This update for slurm2002 fixes the following issues: Updated to 20.02.6, addresses two security fixes: PMIx - fix potential buffer overflows from use of unpackmem. CVE-2020-27745 bsc1178890 X11 forwarding - fix potential leak of the magic cookie when sent as an argument to the xauth command...

Wordpress Simple Board Job Plugin 路径遍历漏洞

Wordpress Simple Board Job Plugin is a plugin from the WordPress Wordpress Foundation that provides job posting functionality job boards for Wordpress. A security vulnerability exists in WordPress Simple Board Job plugin 2.9.3 and earlier versions, which stems from a path traversal vulnerability ...

Simple Job Board < 2.9.4 - Authenticated Path Traversal Leading to Arbitrary File Download

The plugin does not validate the sjbfile parameter when viewing a resume, allowing authenticated user with the downloadresume capability such as HR users to download arbitrary files from the web-server via a path traversal attack The sjbfile parameter to use may depends on the configuration of th...

Simple Job Board < 2.9.4 - Authenticated Path Traversal Leading to Arbitrary File Download

The plugin does not validate the sjbfile parameter when viewing a resume, allowing authenticated user with the downloadresume capability such as HR users to download arbitrary files from the web-server via a path traversal attack PoC The sjbfile parameter to use may depends on the configuration o...

WordPress Simple Job Board plugin <= 2.9.3 - Authenticated Directory Traversal vulnerability

Authenticated Directory Traversal vulnerability found by Arcangelo Saracino in WordPress Simple Job Board plugin versions = 2.9.3. Solution Update the WordPress Simple Job Board plugin to the latest available version at least 2.9.4...

PT-2021-14361

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform with a critical "zip slip" vulnerability that may lead to arbitrary file write. The KubernetesResource REST endpoint untars user-controlled data from the...

GHSA-395W-QHQR-9FR6 Path Traversal in Apache Flink

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

Resumes Management and Job Application Website 1.0 - Multiple Stored XSS

Exploit Title: Resumes Management and Job Application Website 1.0 - Multiple Stored XSS Date: 2/1/2021 Exploit Author: Saswat Subhajyoti Mallick Vendor Homepage: https://egavilanmedia.com/ Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/ Version: 1.0 Tested...

Viki Solutions Viki Vera 跨站脚本漏洞

Viki Solutions Viki Vera is a suite of workflow customization platforms from Canadian company Viki Solutions. The platform supports file uploading, job management, and other features. A security vulnerability exists in Viki Vera 4.9.1.26180, which can be exploited by an attacker to set a user's...

XXL-JOB cross-site scripting vulnerability (CNVD-2021-44699)

XXL-JOB is a distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored cross-site scripting vulnerability exists in XXL-JOB 2.2.0 in the "Add User" section, which can be exploited to bypass a 20-minute vulnerabili...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

Design/Logic Flaw

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

CVE-2020-29204 affects XXL-JOB 2.2.0 with a Stored XSS in the Add User path. The root cause is a bypass of the 20-character limit in xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java, enabling persistent script injection. The NVD and related sources classify the CVSS v3...

SUSE-SU-2020:3892-1 Security update for slurm_20_02

This update for slurm2002 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem bsc1178890. - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command bsc1178891. Non-security...

libquartz: XXE attacks via job description

The Terracotta Quartz Scheduler is susceptible to an XML external entity attack XXE through a job description. This issue stems from inadequate handling of XML external entity XXE declarations in the initDocumentParser function within xml/XMLSchedulingDataProcessor.java. By enticing a victim to...

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP aka CID-54ffccbf053b.

...

Indian job portal IIMJobs hacked; database leaked online

By Waqas According to Alexa traffic analysis, IIMJobs is among the top 700 visited websites in India. Here's what was leaked and what happened. This is a post from HackRead.com Read the original post: Indian job portal IIMJobs hacked; database leaked online...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container Fixed two jQuery vulnerabilities CVE-2020-11022, CVE-2020-11023 Improved Ansible Tower's web service configuration to allow for processing more simultaneous HTTPs requests by default Updated several dependencies of Ansible Tower's User Interface to...