79 matches found
Information Exposure
cockpit-hq/cockpit is vulnerable to Information Exposure. The vulnerability exists because the system does not properly validate /models/Content, which allows an attacker to read sensitive information in the system...
Remote Code Execution (RCE)
cockpit-hq/cockpit is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of file extension validation for user supplied files which allows an attacker to upload and execute malicious PHP code...
Prototype Pollution
cockpit-hq/cockpit is vulnerable to Prototype Pollution. The vulnerability exists due to the use of lodash 4.17.15 which is a platform dependent third party component which allows an attacker to inject properties into existing construct prototypes and modify attributes...
CVE-2023-1313
CVE-2023-1313 affects cockpit-hq/cockpit prior to 2.4.1. The root cause is a lack of extension checking during file uploads, allowing unrestricted uploads of files with dangerous types. This can enable remote code execution on vulnerable servers as described in multiple connected sources. The iss...
CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...
CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...
CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...
Clickjacking
cockpit-hq is vulnerable to Clickjacking. The vulnerability exists due to the lack of the x-frame-options header in admin.php which allows an attacker to misdirect the user, making them click something unintentionally...
Privilege Escalation
cockpit-hq is vulnerable to Privilege Escalation. The vulnerability exists in the save function of Users.php, allowing an attacker to escalate a user role by intercepting the request and modifying the POST data...
CVE-2023-0780
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev...
CVE-2023-0780 Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev...
CVE-2023-0759
CVE-2023-0759 affects Cockpit (cockpit-hq/cockpit) prior to version 2.3.8. The issue is described as a Privilege Chaining vulnerability, with disclosures and advisories consistently noting a fix in 2.3.8 or later. MITRE/attack details are not provided in the connected documents, and there is no e...
CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...
CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...
CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...
Insufficient Session Expiration
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...
CVE-2022-2713
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...
CVE-2022-2713
Cockpit (cockpit-hq/cockpit) before version 2.2.0 is vulnerable to Insufficient Session Expiration. Multiple connected sources describe an access control/session handling issue where expired sessions can be exploited, potentially allowing an attacker to take control of an account. Root cause cite...