1637 matches found
Template Injection
cron-utils is vulnerable to a template Injection vulnerability. The use of cron-utils with @Cron annotation allows an attacker to inject malicious Java EL expressions as it does not properly validate the untrusted Cron expressions, leading to a remote code execution...
Multiple Botnets Exploiting Critical Oracle WebLogic Bug — PATCH NOW
Multiple botnets are targeting thousands of publicly exposed and still unpatched Oracle WebLogic servers to deploy crypto miners and steal sensitive information from infected systems. The attacks are taking aim at a recently patched WebLogic Server vulnerability, which was released by Oracle as...
CVE-2020-26238
A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...
CVE-2020-26238
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...
CVE-2020-26238
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...
Design/Logic Flaw
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...
CVE-2020-26238
Cron-utils contains a template injection vulnerability (CVE-2020-26238) in versions before 9.1.3 that allows an attacker to inject arbitrary Java EL expressions and achieve unauthenticated RCE. The issue affects projects that validate untrusted Cron expressions using the @Cron annotation. Remedy:...
CVE-2020-26238 Critical vulnerability found in cron-utils
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...
ca.ibodrov.concord:testcontainers-concord (>=0.0.2 <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21 <=0.0.41) +245 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (>=2.0.0 <=9.1.2)
com.cronutils:cron-utils MAVEN version =2.0.0, =0.0.2, =0.0.21, =0.0.1, =1.0.30 - com.baomidou:jobs-spring-boot-starter =1.0.3 - com.cronutils:cron-utils-spring =1.0.1 - com.elastisys:autoscaler.core =5.2.2 - com.elastisys:autoscaler.distro.standard =5.2.2 -...
Template injection in cron-utils
Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...
GHSA-PFJ3-56HM-JWQ5 Template injection in cron-utils
Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...
Cron Utils Injection Vulnerability
Cron Utils is a Java codebase for authenticating, parsing, and migrating Cron expressions from the individual developers at Jmrozanec. An injection vulnerability exists in Cron-utils versions prior to 9.1.3, which can be exploited by an attacker to be able to inject arbitrary Java EL expressions,...
JSMon - JavaScript Change Monitor for BugBounty
Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will be notified via Telegram with a message containing a li...
libselinux bug fix and enhancement update
The libselinux packages contain the core library of an SELinux system. The libselinux library provides an API for SELinux applications to get and set process and file security contexts, and to obtain security policy decisions. It is required for any applications that use the SELinux API, and is...
Prey 1.9.6 Unquoted Service Path
Exploit Title: Prey 1.9.6 - "CronService" Unquoted Service Path Discovery by: Ömer Tuygun Discovery Date:16.10.2020 Vendor Homepage: https://preyproject.com/ Software Link: https://preyproject.com/download/ Tested Version: 1.9.6 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 10 P...
cPanel Cross-Site Scripting Vulnerability (CNVD-2020-55179)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel versions prior to 90.0.10, which stems from allowing SELF XSS via the Cron...
cPanel cross-site scripting vulnerability (CNVD-2020-55180)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel versions prior to 90.0.10, which stems from allowing SELF XSS via the Cron...
ismartgate PRO File Upload Vulnerability
iSmartGate is a smart garage door opener system. A security vulnerability exists in ismartgate PRO version 1.5.9, which can be exploited by attackers to conduct privilege escalation attacks by appending PHP code to /cron/mailAdmin.php...
ismartgate PRO /cron/mailAdmin.php Elevation of Privilege Vulnerability
iSmartGate is a smart garage door opener system. A security vulnerability exists in ismartgate PRO /cron/mailAdmin.php that allows remote attackers to exploit the vulnerability to submit special requests that can elevate privileges...