OpenMediaVault Cron Remote Command Execution

OpenMediaVault allows an authenticated user to create cron jobs as arbitrary users on the system. An attacker can abuse this to run arbitrary commands as any user available on the system including root. This module requires Metasploit: https://metasploit.com/download Current source:...

OpenMediaVault Cron Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'OpenMediaVault Cron Remote Command Execution', 'Description' = %q OpenMediaVault allows an authenticated user to create cron jobs as...

[LinEnum v0.2] Automating local information gathering tasks on Linux hosts

LinEnum is a shell script that automates local information gathering tasks on Linux hosts.Over 65 checks are performed, obtaining anything from kernel information to locating possible escalation points such as potentially useful SUID/GUID files and Sudo/rhost mis-configurations etc. Additionally,...

CVE-2013-1879

Cross-site scripting XSS vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."...

CVE-2013-1879

Cross-site scripting XSS vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."...

CVE-2013-1879

CVE-2013-1879 is a Cross-site scripting (XSS) vulnerability in scheduled.jsp of Apache ActiveMQ 5.8.0 and earlier, allowing remote attackers to inject arbitrary script via the cron-of-a-message vector. The IBM/PSirt references note the vulnerability details and base score (4.3) with the same vect...

CVE-2013-1879

Cross-site scripting XSS vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."...

Oracle Linux 5 : Moderate: / vixie-cron (ELSA-2007-0345)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0345 advisory. 4.1-47.EL4 - removed patches for 192783, 178836 because of frozen errata - added only patch for CVE-2007-1856 crontab denial of service - Resolves: rhbz235880...

Oracle Linux 5 : vixie-cron (ELSA-2012-0304)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0304 advisory. - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file Tenable has extracted the preceding...

ActiveMQ: XSS vulnerability in scheduled.jsp

Cross-site scripting XSS vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."...

CentOS 4 : vixie-cron (CESA-2005:361)

An updated vixie-cron package that fixes various bugs and a security issue is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specifie...

Scientific Linux Security Update : selinux-policy enhancement update on SL6.x i386/x86_64 (20130221)

This update adds the following enhancements : - With the Multi-Level Security MLS SELinux policy enabled, a user created with an SELinux MLS level could not login to the system through an |SSH| client. The SELinux policy rules have been updated to allow the user to log in to the system in the...

Solaris 10 (sparc) : 146694-02 (deprecated)

SunOS 5.10: cron patch. Date this patch was last updated by Sun : Feb/06/13 This plugin has been deprecated and either replaced with individual 146694 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12...

Solaris 10 (x86) : 146695-02 (deprecated)

SunOS 5.10x86: cron patch. Date this patch was last updated by Sun : Feb/06/13 This plugin has been deprecated and either replaced with individual 146695 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/1...

Scientific Linux Security Update : selinux-policy enhancement update on SL6.x i386/x86_64 (20121218)

This update adds the following bugfixes : - Due to a bug in the SELinux policy, it was not possible to run a cron job with a valid MLS Multi Level Security context for the sysadmu SELinux user. This update fixes relevant SELinux policy rules and cron now works as expected in the described scenari...

CVE-2012-5537

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron...

Code injection

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron...

CVE-2012-5537

The vulnerability CVE-2012-5537 affects the Simplenews Scheduler module for Drupal (6.x-2.x series) prior to 6.x-2.4. An authenticated user with the 'send scheduled newsletters' permission can inject arbitrary PHP code into the scheduling form, which is later executed by cron, enabling code execu...

Mandrake Linux Security Advisory : vixie-cron (MDKSA-2001:022)

A buffer overflow exists in the 'crontab' command if it was called by a user with a username longer than 20 characters. If the system administrator has created usernames of that length, it would be possible for those users to gain elevated privileges. %NASLMINLEVEL 70300 C Tenable Network Securit...

Fedora Update for puppet FEDORA-2012-6674

Check for the Version of puppet OpenVAS Vulnerability Test Fedora Update for puppet FEDORA-2012-6674 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...