PT-2018-5687 · Red Hat · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit version 0.13.0 Description: The issue allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts. This is related to the use of the discontinued aheinze/fetch url contents component, specifically via the url...

Sever Side Request Forgery (SSRF)

aheinze/cockpit is vulnerable to server side request forgery SSRF attacks. The attack is possible because it through the window.fetchurlcontents function, allowing a malicious user to read arbitrary files, scan network ports, carry out information detection and internal network server attacks...

Cockpit CMS 0.13.0 Server Side Request Forgery Vulnerability

Cockpit CMS version 0.13.0 suffers from a server-side request forgery vulnerability. SSRFPS"Server Side Request ForgeryPSc in Cockpit CMS 0.13.0 CVE-2017-14611 The Cockpit CMS is awesome if you need a flexible content structure but don't want to be limited in how to use the content. Product...

Cockpit CMS 0.13.0 Server Side Request Forgery

SSRFPS"Server Side Request ForgeryPSc in Cockpit CMS 0.13.0 CVE-2017-14611 The Cockpit CMS is awesome if you need a flexible content structure but don't want to be limited in how to use the content. Product Download: https://getcockpit.com/ Vulnerability TypePSoSSRFPS"Server Side Request ForgeryP...

(RHSA-2018:0047) Important: redhat-virtualization-host security update

The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts RHVH are installed using a special build of Red Hat Enterprise Linux with only the packages required to host...

SAP HANA Cockpit for Offline Administration Information Disclosure Vulnerability

SAP HANA is a suite of real-time data analytics platforms from Germany's SAP. An information disclosure vulnerability exists in SAP HANA Cockpit for Offline Administration. An attacker can exploit the vulnerability to obtain sensitive information that could lead to running further attacks...

SAP HANA Cockpit Cross-Site Scripting Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A cross-site scripting vulnerability exists in SAP HANA. As the program fails to properly filter...

devolo Cockpit - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application devolo Cockpit published at the 'play' market has multiple vulnerabilities...

Jetro Cockpit Secure Browsing code execution

Code execution via print-to-PDF function...

Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE

CVE-2014-1861 Affected versions: 4.3.3 4.3.1 and probably prior versions. Jetro Cockpit Secure Browsing makes use of a client running on a user's workstation in the enterprise's internal network, and a server in the DMZ that connects on the client's behalf to the internet. Attack scenario: User...

CVE-2014-1861

The client in Jetro COCKPIT Secure Browsing JCSB 4.3.1 and 4.3.3 does not validate the FileName element in an RDPFILETRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension...

CVE-2014-1861

The CVE-2014-1861 entry affects Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3. The issue is that the client does not validate the FileName element in an RDP_FILE_TRANSFER document, allowing a remote JCSB server to cause RCE by supplying a .EXE extension. This can enable arbitrary code exec...

CVE-2014-1861

The client in Jetro COCKPIT Secure Browsing JCSB 4.3.1 and 4.3.3 does not validate the FileName element in an RDPFILETRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension...

Hijacking plane's navigation system with an Android app, Researcher claimed

It is a terrifying prospect, a hack that allows an attacker to take control of plane navigation and cockpit systems has been revealed at a security conference in Europe. This was demonstrated by Hugo Teso, a researcher at security consultancy N.Runs in Germany who's also a commercial airline pilo...

Hijacking plane's navigation system with an Android app, Researcher claimed

It is a terrifying prospect, a hack that allows an attacker to take control of plane navigation and cockpit systems has been revealed at a security conference in Europe. This was demonstrated by Hugo Teso, a researcher at security consultancy N.Runs in Germany who's also a commercial airline pilo...