CVE-2023-37272: Improper Neutralization of Input During Web Page Generation

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

PT-2023-25875

Name of the Vulnerable Software and Affected Versions JobScheduler JS1 versions 1.13.0 through 1.13.18 Description The issue allows for an XSS attack through specifically crafted file names when uploading files for user-generated documentation in JOC Cockpit. This can inject code that is executed...

cockpit-appstream bug fix update

An update is available for cockpit-appstream. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dummy package from building optional packages only; never install o...

Image Builder security, bug fix, and enhancement update

cockpit-composer 45-1.0.1 - Make per page documentation links point to Oracle Linux Orabug: 32013095, Orabug:34398922 45-1 - New upstream release 44-1 - New upstream release 43-1 - New upstream release 42-1 - New upstream release osbuild 81-1 - New upstream release 80-1 - New upstream release 79-...

Important: Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update batch#5 (oVirt-4.5.3-5)

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

Remote Code Execution (RCE)

cockpit-hq/cockpit is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of file extension validation for user supplied files which allows an attacker to upload and execute malicious PHP code...

Prototype Pollution

cockpit-hq/cockpit is vulnerable to Prototype Pollution. The vulnerability exists due to the use of lodash 4.17.15 which is a platform dependent third party component which allows an attacker to inject properties into existing construct prototypes and modify attributes...

Cockpit 代码问题漏洞

Cockpit is an interactive server management interface. A code issue vulnerability exists in versions prior to Cockpit 2.4.1 that stems from a lack of extension checking during file uploads. An attacker can exploit this vulnerability to execute malicious code in the server...

CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

CVE-2023-1313: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

CVE-2023-1313

CVE-2023-1313 affects cockpit-hq/cockpit prior to 2.4.1. The root cause is a lack of extension checking during file uploads, allowing unrestricted uploads of files with dangerous types. This can enable remote code execution on vulnerable servers as described in multiple connected sources. The iss...

CVE-2023-1313

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

GHSA-P8CQ-PV6W-6RWX Cockpit Uses Platform-Dependent Third Party Components

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit 2.3.9 and prior. A patch is available and anticipated to be part of version 2.4.0...

Cockpit 安全漏洞

Cockpit is an interactive server management interface. A security vulnerability exists in Cockpit versions prior to 2.4.0, which stems from the use of platform-dependent third-party components...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

PT-2023-16790 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: cockpit versions prior to 2.4.0 Description: The issue concerns the use of platform-dependent third-party components in the GitHub repository cockpit-hq/cockpit. A patch is available and is anticipated to be part of version 2.4.0...

CVE-2023-1160

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

CVE-2023-1160: Use of Platform-Dependent Third Party Components

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

CVE-2023-1055

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes...