PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

PowerJob V4.3.1 - Authentication Bypass

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. id: CVE-2023-29922 info: name: PowerJob V4.3.1 - Authentication Bypass author: Co5mos severity: medium description: | PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save...

Powerjob-CVE-2023-29922-

Powerjob-CVE-2023-29922-...

CVE-2026-75431_PowerJob_jwt_key_predictable

PowerJob JWT署名キーの予測可能性（デフォルトJDBC URLから導出されるキー）→ トークン偽造 1. 概要 PowerJob ServerのJWT（HS256）署名キーは、ハードコードされた定数とデフォルトJDBC URLのMD5を連結したものをBASE64デコード して導出されます（DefaultSecretProvider / JwtServiceImpl）。JDBC URLはデフォルトのデプロイメント（docker-compose / application-daily.properties）で公開されているため、攻撃者はキーを完全にオフラインで導出...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker の /worker/deployContainer 経由の認証なしリモートコード実行（任意JARロード） 1. 概要 PowerJob Worker は、HTTPトランスポートポート27777上で deployContainer ハンドラをいかなる認証もなしに 公開しています。攻撃者は任意のURLを送信し、Worker はそのJARをダウンロードして URLClassLoader と Spring ClassPathXmlApplicationContext を介してロードし、Spring の init-method 中に任意のコードを実行します →...

CVE-2026-75429_PowerJob_friend_process_RCE

PowerJob Server における未認証の /friend/process（Groovy インジェクション）によるリモートコード実行 1. 概要 PowerJob Server（分散ジョブスケジューリング／コンピューティングフレームワーク）は、Worker↔Server 間トランスポート層の HTTP ポート 10010 において、/friend/process エンドポイントを一切の認証なしで 公開しています。このエンドポイントは、任意の Spring Bean の任意のパブリックメソッドをリフレクションで呼び出します。攻撃者が GroovyEvaluator.evaluate...

CVE-2023-29923-Scan

CVE-2023-29923-Scan PowerJob =4.3.2 무단 접근 취약점 탐지 도구 CVE-2023-29922...

CVE-2023-29923

PowerJob V4.3.1 인가되지 않은 취약점 이 프로젝트를 사용하여 웹사이트에 CVE-2023-29923 취약점이 있는지 확인하고 배치 검증을 지원할 수 있습니다. 사용 방법: 1. python3 CVE-2023-29923.py -u "http://ip:port" 2. python3 CVE-2023-29923.py -f url.txt...

PowerJob List - Authorization Bypass

PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges. id: CVE-2025-11580 info: name: PowerJob List - Authorization Bypass author: DhiyaneshDk severit...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness through the JWT signing flow in DefaultSecretProvider and JwtServiceImpl under powerjob-server-auth. An attacker can forge HS256-signed JWTs by using the predictable signing key and then send those tokens to the serv...

tech.powerjob:powerjob-server-starter (>=5.0.0-beta, <=5.1.1) potentially affected by CVE-2026-75431 via tech.powerjob:powerjob-server-auth (>=5.0.0-beta, <=5.1.1)

tech.powerjob:powerjob-server-auth MAVEN version =5.0.0-beta, =5.0.0-beta, =5.1.1 Source cves: CVE-2026-75431 Source advisory: SNYK:JAVA-TECHPOWERJOB-19644147...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

PT-2026-85685

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

EUVD-2026-71612

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-75429

The PowerJob distributed job scheduling and computing framework (versions 4.x through 5.1.2 ) is vulnerable to unauthenticated remote code execution (RCE) . The issue exists in the Server-Worker transport layer because the /friend/process endpoint is exposed without any authentication on HTTP por...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-75430

PowerJob Worker version 5.1.2 (and likely earlier) exposes the /worker/deployContainer HTTP endpoint without authentication on its default transport port, allowing a remote unauthenticated attacker to execute arbitrary code . The vulnerability is scored CVSS 9.8 (Critical) — network attack vector...