Xuxueli Archives - CVE Vulnerability

CVE-2018-20094

Sun, 26 Feb 2023 06:48:27 +0000

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.

The post CVE-2018-20094 appeared first on CVE Vulnerability.

CVE-2020-29204

Sun, 26 Feb 2023 06:40:53 +0000

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

The post CVE-2020-29204 appeared first on CVE Vulnerability.

CVE-2020-23811

Sun, 26 Feb 2023 06:39:19 +0000

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

The post CVE-2020-23811 appeared first on CVE Vulnerability.

CVE-2020-23814

Sun, 26 Feb 2023 06:39:19 +0000

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.

The post CVE-2020-23814 appeared first on CVE Vulnerability.

CVE-2022-43183

godfreyd94 — Thu, 23 Feb 2023 05:21:07 +0000

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

The post CVE-2022-43183 appeared first on CVE Vulnerability.

CVE-2022-40929

godfreyd94 — Thu, 23 Feb 2023 05:20:40 +0000

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

The post CVE-2022-40929 appeared first on CVE Vulnerability.

CVE-2022-36157

godfreyd94 — Thu, 23 Feb 2023 05:19:48 +0000

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.

The post CVE-2022-36157 appeared first on CVE Vulnerability.

CVE-2022-29770

godfreyd94 — Thu, 23 Feb 2023 05:18:31 +0000

XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

The post CVE-2022-29770 appeared first on CVE Vulnerability.

CVE-2022-29002

godfreyd94 — Thu, 23 Feb 2023 05:18:21 +0000

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

The post CVE-2022-29002 appeared first on CVE Vulnerability.

CVE-2023-0674

godfreyd94 — Wed, 22 Feb 2023 14:02:15 +0000

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.

The post CVE-2023-0674 appeared first on CVE Vulnerability.