xxl-job

CVE-2020-29204

February 26, 2023 by

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

CVE-2020-23811

February 26, 2023 by

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.

CVE-2022-43183

February 23, 2023 by godfreyd94

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

CVE-2022-40929

February 23, 2023 by godfreyd94

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

CVE-2022-36157

February 23, 2023 by godfreyd94

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.