2011 matches found
CVE-2021-27557
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
CVE-2021-27557
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
CVE-2021-27556
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...
CVE-2021-27556
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
CVE-2021-27557
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
Code injection
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...
CVE-2021-27557
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
CVE-2021-27557
The CVE-2021-27557 entry describes a CSRF vulnerability in the Cron job tab of EasyCorp ZenTao 12.5.3, allowing an attacker to update fields of a Cron job. The issue is confirmed across multiple sources (NVD, Red Hat, OSV) as a CSRF flaw in ZenTao 12.5.3. The root cause is cross-site request forg...
CVE-2021-27556
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...
CVE-2021-27556
CVE-2021-27556 concerns EasyCorp ZenTao 12.5.3, where the Cron job tab can be abused by an admin to set the type parameter to System and execute arbitrary code. The underlying issue is a parameter handling flaw in the Cron tab that enables remote code execution. Documents consistently describe co...
CVE-2021-27557: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job...
PT-2021-17506
Name of the Vulnerable Software and Affected Versions EasyCorp ZenTao version 12.5.3 Description The issue allows remote attackers with admin access to execute arbitrary code by setting the type parameter to System in the Cron job tab. Recommendations For EasyCorp ZenTao version 12.5.3, consider...
Nature Easy Soft Network Technology ZenTao 操作系统命令注入漏洞
Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions...
CVE-2021-27556: Improper Neutralization of Special Elements used in an OS Command
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers who have admin access to execute arbitrary code by setting the type parameter to System...
Nature Easy Soft Network Technology ZenTao 跨站请求伪造漏洞
Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes features such as product management, project management, quality management and document...
PT-2021-17507
Name of the Vulnerable Software and Affected Versions EasyCorp ZenTao version 12.5.3 Description A cross-site request forgery CSRF vulnerability in the Cron job tab allows attackers to update the fields of a Cron job. Recommendations For EasyCorp ZenTao version 12.5.3, consider disabling access t...
cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution
A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...
cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution
A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...