531 matches found
cobbler: command injection flaw in the power management XML-RPC API
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
Fedora 17 2012-9621
Cobbler is a network install server. Cobbler supports PXE, virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. There is also a web interface 'cobbler-web'. Cobbler's advanced features include importing...
CVE-2012-2395
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
CVE-2012-2395
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
UBUNTU-CVE-2012-2395
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
Input validation
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
CVE-2012-2395
Incomplete blacklist vulnerability in actionpower.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...
CVE-2012-2395
CVE-2012-2395 corresponds to a command-injection flaw in Cobbler's XML-RPC power_system API (action_power.py). The root cause is an incomplete blacklist allowing shell metacharacters in the username or password fields, enabling remote command execution. The CVE affected Cobbler 2.2.0, with a NVD ...
Cobbler xmlrpc API power_system Method Remote Shell Command Execution
According to its self-reported version, the Cobbler install on the remote host is affected by a command injection vulnerability that can be exploited by sending a specially crafted username or password argument to the 'powersystem' method. Successful exploitation requires an authenticated user an...
Cobbler Linux Installation Server Detection
The remote host is running Cobbler, a Linux installation and update server. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid59401; scriptversion"1.3"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Cobbler Linux Installation Server Detection";...
Cobbler Admin Interface Detection
A web-based administration interface for Cobbler, a Linux installation server, was detected on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid59400; scriptversion"1.3"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Cobbler Admin Interface...
update for cobbler (important)
The xmlrpc interface of cobbler was prone to command injectoin...
CVE-2011-1550
The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as...
CVE-2011-1551
SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon...
CVE-2011-1551
SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon...
Default configuration
The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as...
CVE-2011-1551
SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon...
CVE-2011-1550
The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as...
CVE-2011-1551
The CVE-2011-1551 issue affects openSUSE/SUSE Cobbler: the /var/log/cobbler/ directory is owned by the web-service user, which may allow local users to escalate privileges when Cobbler performs root filesystem operations. The connected documents confirm this local-privilege-elevation risk without...