Quartz

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2023-39017 Jul 28, 15:15 CRITICAL POC Act Now

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection Quartz Softwareag

NVD GitHub

CVSS 3.1

9.8

EPSS

1.0%

CVE-2019-13990 Jul 26, 19:15 Maven CRITICAL PATCH Act Now

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Apache Java XXE Oracle Atlassian +33

NVD GitHub VulDB

CVSS 3.1

9.8

EPSS

16.2%

CVE-2023-39017

EPSS 1% CVSS 9.8

CRITICAL POC Act Now

RCE Code Injection Quartz +1

NVD GitHub

CVE-2019-13990 Maven

EPSS 16% CVSS 9.8

CRITICAL PATCH Act Now

Apache Java XXE +35

NVD GitHub VulDB