Quartz

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2023-39017 CRITICAL POC Act Now

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection Quartz

NVD GitHub

CVSS 3.1

9.8

EPSS

1.0%

CVE-2019-13990 Maven CRITICAL PATCH Act Now

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

XXE Java Quartz Apache Batik Mapviewer Banking Enterprise Originations +28

NVD GitHub

CVSS 3.1

9.8

EPSS

16.2%

CVE-2023-39017

EPSS 1% CVSS 9.8

CRITICAL POC Act Now

RCE Code Injection Quartz

NVD GitHub

CVE-2019-13990 Maven

EPSS 16% CVSS 9.8

CRITICAL PATCH Act Now

XXE Java Quartz +30

NVD GitHub