Cross site scripting

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

CVE-2020-18324

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

PT-2022-8590

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description A Cross Site Scripting XSS issue exists via the q parameter in the Kickstart template, allowing for potential malicious script execution. Recommendations For Subrion CMS version 4.2.1, consider disabling t...

Subrion CMS 跨站脚本漏洞

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...

Design/Logic Flaw

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

CVE-2010-2235

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

PT-2010-3833

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 2.0.7 Description The issue allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file. This is due to the template api.py file not disabling the ability of the Cheetah...

CVE-2008-6954

The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...

Code injection

The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...

CVE-2008-6954

CVE-2008-6954 affects CobblerWeb in Cobbler before 1.2.9, where the Cheetah template engine can execute Python statements embedded in kickstart templates. This enables remote authenticated users to run arbitrary Python code in cobblerd, effectively compromising the server. The vulnerability stems...

Cobbler Web接口kickstat模板远程特权权限漏洞

BUGTRAQ ID: 32317 CNCAN ID：CNCAN-2008112101 Cobbler是一款网络安全服务器。 Cobbler WEB接口存在远程特权提升问题，远程攻击者可以利用漏洞以root特权执行python代码。 问题存在于kickstart模板存在安全问题，目前没有详细漏洞细节提供。 RedHat Fedora 9 RedHat Fedora 8 Cobbler Cobbler 1.2.8 升级程序： Cobbler Cobbler 1.2.8 1 Cobbler cobbler-1.2.9.tar.gz...