CVE-2023-4422 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3...

CVE-2023-4422

CVE-2023-4422 affects Cockpit: a stored Cross-site Scripting (XSS) vulnerability in cockpit-hq/cockpit prior to version 2.6.3. Public sources (NVD/NVDS, OSV, GHSA, CIRCL, PT-2023-29151) describe the issue as a stored XSS that can affect users viewing stored input, with each entry reaffirming that...

Cross-Site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability occurs because the library does not properly escape user input when rendering templates, allowing an authenticated attacker to inject malicious JavaScript code into a Cockpit page, which would then be executed...

GHSA-5CV4-48H7-7782 Cockpit Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit 2.6.3 and prior. A patch is available at commit 36d1d4d256cbbab028342ba10cc493e5c119172c and anticipated to be part of version 2.6.4...

CVE-2023-4395 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4...

CVE-2023-4395

Cockpit XSS vulnerability (CVE-2023-4395) affects cockpit-hq/cockpit prior to version 2.6.4. The issue is a Stored XSS in the web UI, caused by input not being properly escaped in templates, allowing an authenticated attacker to inject JavaScript into Cockpit pages (Veracode description). Public ...

CVE-2023-4395 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4...

Cross-site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists because xhtml files are not restricted which allows an attacker to upload a xhtml files in the assets manager, resulting in XSS when viewed...

CVE-2023-4321

CVE-2023-4321 is a stored XSS in Cockpit (cockpit-hq/cockpit) prior to version 2.4.3. The vulnerability affects Cockpit’s web interface by storing and reflecting malicious input. CVSS v3.1 base score is 6.1 (MEDIUM) with Network access, no privileges required, UI interaction required, and confide...

CVE-2023-4321 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3...

CVE-2023-4321 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3...

Cross-site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to bootstrap.php accepting html files as an upload, which allows an attacker to inject and execute malicious Javascript into the browser...

Remote Code Execution

cockpit-hq/cockpit is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a lack of file upload sanitization in bootstrap.php which allows an attacker to inject and execute malicious PHP code by uploading a php file with an extension such as phps...

CVE-2023-4196

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3...

CVE-2023-4196

CVE-2023-4196 affects Cockpit (cockpit-hq/cockpit) versions prior to 2.6.3. It is a stored XSS vulnerability where an attacker with permission to execute function assets can cause an XSS by uploading an HTML file, leading to code execution in the victim’s browser. The issue’s root cause is insuff...

CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3...

CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3...

CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3...

Cross-Site Request Forgery (CSRF)

cockpit-hq/cockpit is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in multiple functions of the Admin portal, which allows an attacker to execute arbitrary administrator commands...

Cross-Site Request Forgery (CSRF)

cockpit-hq/cockpit is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists because it does not use a csrf token, which allows an attacker to execute arbitrary commands on the system as an administrator...