1904 matches found
CVE-2018-15538
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities...
CVE-2018-15539
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
CVE-2018-15540
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal...
CVE-2018-15538
CVE-2018-15538 affects Agentejo Cockpit, a CMS for managing structured content. The CNVD entry CNVD-2018-21183 documents a Cross-Site Scripting vulnerability in Cockpit, specifically affecting version 0.6.2, enabling a remote attacker to inject arbitrary web script or HTML. The 0.6.2 release refe...
CVE-2018-15539
Agentejo Cockpit (Cockpit CMS) is affected by CVE-2018-15539 due to a lack of anti-CSRF protection. Multiple connected sources confirm a CSRF vulnerability that enables unauthorized actions such as changing API tokens and passwords. The CNVD entry explicitly notes a CSRF vulnerability in Cockpit ...
CVE-2018-15540
Agentejo Cockpit exposes a Directory Traversal vulnerability (CVE-2018-15540) due to insufficient validation when performing file operations via the /cockpit/media/api interface. The CNVD entry notes a traversal path allowing an attacker to move the filesystem and access arbitrary files in Cockpi...
PT-2018-13074
Name of the Vulnerable Software and Affected Versions Agentejo Cockpit affected versions not specified Description The issue involves multiple Cross-Site Scripting vulnerabilities. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
CVE-2018-15539: Cross-Site Request Forgery (CSRF)
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
CVE-2018-15540: Improper Limitation of a Pathname to a Restricted Directory
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal...
CVE-2018-15538: Improper Neutralization of Input During Web Page Generation
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities...
PT-2018-13077
Name of the Vulnerable Software and Affected Versions Agentejo Cockpit affected versions not specified Description The issue allows an attacker to traverse the file system to unintended locations and/or access arbitrary files due to a lack of appropriate validation when performing actions on file...
PT-2018-13075
Name of the Vulnerable Software and Affected Versions Agentejo Cockpit affected versions not specified Description The issue is related to the lack of an anti-CSRF protection mechanism. This allows an attacker to modify sensitive information such as API tokens and passwords. Recommendations At th...
Cockpit CMS CSRF / XSS / Path Traversal
1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via requests to /cockpit/media/api Example of a vulnerable request: POST /cockpit/media/api HTTP/1.1 Host: 192.168.5.129 User-Agent: Mozilla/5.0 Windows NT 10....
Cockpit CMS CSRF / XSS / Path Traversal Vulnerabilities
Cockpit CMS suffers from cross site request forgery, cross site scripting, and traversal vulnerabilities. Version 0.6.2 should address these issues. 1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via reques...
RHEL 7 : Red Hat Virtualization (RHSA-2018:2626)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2626 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-nod...
Moderate: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Moderate: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
Updated redhat-virtualization-host packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...
Important: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...
