Cockpit CMS 跨站请求伪造漏洞

Cockpit is an interactive server management interface. A security vulnerability exists in Cockpit CMS version 2.5.2 that stems from the presence of a cross-site request forgery CSRF vulnerability. An attacker can exploit this vulnerability to execute arbitrary administrator commands...

CVE-2023-37649: Undefined Security Weakness

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

PT-2023-26060 · Unknown · Cockpit Cms

Name of the Vulnerable Software and Affected Versions: Cockpit CMS version 2.5.2 Description: A Cross-Site Request Forgery CSRF in the Admin portal allows attackers to execute arbitrary Administrator commands. Recommendations: For Cockpit CMS version 2.5.2, consider disabling access to the Admin...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37650

CVE-2023-37650 is a CSRF vulnerability in the Cockpit CMS Admin portal for version 2.5.2, allowing an attacker to execute arbitrary administrator commands. The CVE description and multiple connected reports (Red Hat, Veracode, GHSA) consistently describe CSRF arising in the Admin portal; some sou...

PT-2023-26059

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.5.2 Description The issue is related to incorrect access control in the /models/Content component, allowing unauthorized attackers to access sensitive data. Recommendations For Cockpit CMS version 2.5.2, update to a versi...

CVE-2023-37649

CVE-2023-37649 affects Cockpit CMS v2.5.2, with an improper access control vulnerability in the component /models/Content that allows unauthorized attackers to access sensitive data. The associated CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) yields a base score of 7.5 (HIGH). Multiple ...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37650: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37272

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

Cockpit 跨站脚本漏洞

Cockpit is an interactive server management interface. A cross-site scripting vulnerability exists in versions prior to joc-cockpit 1.13.19, which stems from the need to specify a filename when uploading a file containing a user-generated JOC Cockpit document, which can be exploited by an attacke...