GHSA-8WJ3-CPMR-8WHP Cockpit Content Platform vulnerable to 2FA bypass

Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication 2FA bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part...

Improper Authentication

Authentication Bypass by Primary Weakness in GitHub repository cockpit-hq/cockpit prior to 2.2.2...

CVE-2022-2818

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2...

CVE-2022-2818 Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2...

Cockpit 授权问题漏洞

Cockpit is an interactive server management interface. An authorization issue vulnerability exists in versions of Cockpit prior to 2.2.2, which stems from a bypass of the authentication mechanism...

PT-2022-18867 · Unknown · Cockpit Content Platform

Name of the Vulnerable Software and Affected Versions: Cockpit Content Platform versions prior to 2.2.2 Description: The issue concerns the improper removal of sensitive information before storage or transfer, and it also involves a two-factor authentication 2FA bypass. The 2FA secret is disclose...

2FA Bypass in Cockpit Content Platform ≤ v2.2.1

Description 2FA secret is disclosed in JWT token after user logs into his account in Cockpit Content Platform ≤ v2.2.1 allowing attacker to bypass the 2FA code. Proof of Concept 1.Login with your admin account and enable 2FA in your account and logout. 2.Go to...

Cockpit Access Control Error Vulnerability

Cockpit is an interactive server management interface. An access control error vulnerability exists in Cockpit versions prior to 2.2.0 that stems from insufficient session expiration. An attacker could exploit the vulnerability to take control of an account using expired session credentials...

Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password...

GHSA-VM6P-35RW-3FXC Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password...

Insufficient Session Expiration

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

CVE-2022-2713

Cockpit (cockpit-hq/cockpit) before version 2.2.0 is vulnerable to Insufficient Session Expiration. Multiple connected sources describe an access control/session handling issue where expired sessions can be exploited, potentially allowing an attacker to take control of an account. Root cause cite...

CVE-2022-2713 Insufficient Session Expiration in cockpit-hq/cockpit

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

Cockpit 代码问题漏洞

Cockpit is an interactive server management interface. An access control error vulnerability exists in Cockpit versions prior to 2.2.0 that stems from insufficient session expiration. An attacker could exploit the vulnerability to take control of an account using expired session credentials...

PT-2022-18239 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit versions prior to 2.2.0 Description: The issue is related to insufficient session expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin chang...

Insufficient Session Expiration After Password Change

Description During my test, I found that in Cockpit v 2.1.2, the application was not validating the request after password change. This allows attacker to update user account details even after admin changes password. Steps to Reproduce : 1. Login with your account and click on click on "Account...

Fedora: Security Advisory for osbuild-composer (FEDORA-2022-ca66b145a5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Cockpit component in the SAP Business One resource management system and the SAP HANA database management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Cockpit component in the SAP Business One resource management system and the SAP HANA database management system is related to deficiencies in the separation of controlled areas within the system. Exploiting this vulnerability could allow an attacker operating remotely to...