CVE-2020-35846

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function...

CVE-2020-35848

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function...

Sql injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function...

Sql injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function...

Sql injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function...

CVE-2020-35846

Agentejo Cockpit (Cockpit CMS) before version 0.11.2 is vulnerable to a NoSQL injection via the Controller/Auth.php check function. The NoSQL query using the $eq operator can allow unauthorized access and potential data exposure or manipulation. Affected versions are

CVE-2020-35846

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function...

CVE-2020-35848

CVE-2020-35848 affects Agentejo Cockpit prior to 0.11.2, where the NoSQL injection vulnerability exists in the Auth controller’s newpassword path. The connected sources consistently describe exploitation via /auth/resetpassword and /auth/newpassword, enabling manipulation of database queries and ...

CVE-2020-35848

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function...

CVE-2020-35847

CVE-2020-35847 affects Agentejo Cockpit (Cockpit CMS) versions before 0.11.2. The NoSQL injection occurs in Controller/Auth.php resetpassword (and related endpoints) allowing manipulation of NoSQL queries, which can enable user enumeration and extraction of password reset tokens, potentially enab...

CVE-2020-35847

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function...

CVE-2020-35847

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Recent assessments: h00die at May 31, 2021 12:11pm UTC reported: Similar to CVE-2020-35846, this is a noSQL injection using the vardump function to dump all memory for the password reset...

CVE-2020-35846

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Recent assessments: h00die at May 31, 2021 12:07pm UTC reported: noSQL injection within the /auth/requestreset API. By sending JSON.generate 'user' = '$func' = 'vardump' it causes the vardump functio...

Agentejo Cockpit NoSQL Injection Vulnerability (CNVD-2021-01561)

Agentejo Cockpit is a self-hosted "headless" and api-driven lightweight, open source content management system. A NoSQL injection vulnerability exists in Agentejo Cockpit versions prior to 0.11.2. The vulnerability can be exploited to conduct a NoSQL injection attack via the Controller/Auth.php...

CVE-2020-35846: Improper Neutralization of Special Elements used in an SQL Command

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function...

PT-2020-17487

Name of the Vulnerable Software and Affected Versions Cockpit version 234 Description A Server-Side Request Forgery SSRF issue was discovered. The vendor has stated that they do not think it is a big real-life issue. This issue is unrelated to the Agentejo Cockpit product. Recommendations For...

Agentejo Cockpit NoSQL Injection Vulnerability

Agentejo Cockpit is a self-hosted "headless" and api driven lightweight, open source content management system. A NoSQL injection vulnerability exists in Agentejo Cockpit prior to version 0.11.2. The vulnerability can be exploited to conduct a NoSQL injection attack via the Controller/Auth.php...

CVE-2020-35850: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think it is a big real-life issue...

CVE-2020-35847: Improper Neutralization of Special Elements used in an SQL Command

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function...

CVE-2020-35848: Improper Neutralization of Special Elements used in an SQL Command

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function...