CVE-2018-9302: Server-Side Request Forgery (SSRF)

SSRF Server Side Request Forgery in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about...

Cockpit CMS 0.5.5 Server-Side Request Forgery

SSRFPS"Server Side Request ForgeryPSc in Cockpit 0.4.4-0.5.5 CVE-2018-9302 Cockpit CMS repairs CVE-2017-14611, but it can be bypassed, SSRF still exist, affecting the Cockpit CMS 0.4.4-0.5.5 versions.I've been tested success of "Cockpit CMS" lastest version. Product Download: Cockpit...

Cockpit Server-Side Request Forgery Vulnerability

Cockpit is an open source CMS Content Management System for managing structured content. A server-side request forgery vulnerability exists in Cockpit version 0.13.0. A remote attacker can exploit this vulnerability to read arbitrary files or send TCP traffic to an internal network host with the...

CVE-2017-14611

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

CVE-2017-14611

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

Server side request forgery (ssrf)

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

CVE-2017-14611

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

CVE-2017-14611

Summary: The dataset confirms a Server-Side Request Forgery (SSRF) in Cockpit CMS. Cockpit 0.13.0 was vulnerable via the url parameter (related to the aheinze/fetch_url_contents component). Related entries show that CVE-2018-9302 describes continued SSRF in Cockpit 0.4.4 through 0.5.5, attributed...

PT-2018-5687 · Red Hat · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit version 0.13.0 Description: The issue allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts. This is related to the use of the discontinued aheinze/fetch url contents component, specifically via the url...

CVE-2017-14611: Server-Side Request Forgery (SSRF)

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

Sever Side Request Forgery (SSRF)

aheinze/cockpit is vulnerable to server side request forgery SSRF attacks. The attack is possible because it through the window.fetchurlcontents function, allowing a malicious user to read arbitrary files, scan network ports, carry out information detection and internal network server attacks...

Cockpit CMS 0.13.0 Server Side Request Forgery Vulnerability

Cockpit CMS version 0.13.0 suffers from a server-side request forgery vulnerability. SSRFPS"Server Side Request ForgeryPSc in Cockpit CMS 0.13.0 CVE-2017-14611 The Cockpit CMS is awesome if you need a flexible content structure but don't want to be limited in how to use the content. Product...

Cockpit CMS 0.13.0 Server Side Request Forgery

SSRFPS"Server Side Request ForgeryPSc in Cockpit CMS 0.13.0 CVE-2017-14611 The Cockpit CMS is awesome if you need a flexible content structure but don't want to be limited in how to use the content. Product Download: https://getcockpit.com/ Vulnerability TypePSoSSRFPS"Server Side Request ForgeryP...

(RHSA-2018:0047) Important: redhat-virtualization-host security update

The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts RHVH are installed using a special build of Red Hat Enterprise Linux with only the packages required to host...

SAP HANA Cockpit for Offline Administration Information Disclosure Vulnerability

SAP HANA is a suite of real-time data analytics platforms from Germany's SAP. An information disclosure vulnerability exists in SAP HANA Cockpit for Offline Administration. An attacker can exploit the vulnerability to obtain sensitive information that could lead to running further attacks...

SAP HANA Cockpit Cross-Site Scripting Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A cross-site scripting vulnerability exists in SAP HANA. As the program fails to properly filter...

devolo Cockpit - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application devolo Cockpit published at the 'play' market has multiple vulnerabilities...

Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE

CVE-2014-1861 Affected versions: 4.3.3 4.3.1 and probably prior versions. Jetro Cockpit Secure Browsing makes use of a client running on a user's workstation in the enterprise's internal network, and a server in the DMZ that connects on the client's behalf to the internet. Attack scenario: User...

Jetro Cockpit Secure Browsing code execution

Code execution via print-to-PDF function...

CVE-2014-1861

The client in Jetro COCKPIT Secure Browsing JCSB 4.3.1 and 4.3.3 does not validate the FileName element in an RDPFILETRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension...