Show filters
20 Total Results
Displaying 1-10 of 20
Sort by:
Attacker Value
Unknown
CVE-2024-42681
Disclosure Date: August 15, 2024 (last updated August 20, 2024)
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
0
Attacker Value
Unknown
CVE-2024-3366
Disclosure Date: April 06, 2024 (last updated April 11, 2024)
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.
0
Attacker Value
Unknown
CVE-2024-24113
Disclosure Date: February 08, 2024 (last updated February 15, 2024)
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
0
Attacker Value
Unknown
CVE-2023-48089
Disclosure Date: November 15, 2023 (last updated November 21, 2023)
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.
0
Attacker Value
Unknown
CVE-2023-48088
Disclosure Date: November 15, 2023 (last updated November 21, 2023)
xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.
0
Attacker Value
Unknown
CVE-2023-48087
Disclosure Date: November 15, 2023 (last updated November 21, 2023)
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.
0
Attacker Value
Unknown
CVE-2020-24922
Disclosure Date: August 11, 2023 (last updated October 08, 2023)
Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.
0
Attacker Value
Unknown
CVE-2023-33779
Disclosure Date: May 26, 2023 (last updated February 25, 2025)
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
0
Attacker Value
Unknown
CVE-2023-26120
Disclosure Date: April 10, 2023 (last updated February 24, 2025)
This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.
0
Attacker Value
Unknown
CVE-2023-27087
Disclosure Date: March 21, 2023 (last updated October 08, 2023)
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
0
