CVE-2020-10788: Use of Hard-coded Credentials

openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections...

CVE-2020-10790: Improper Neutralization of Input During Web Page Generation

openITCOCKPIT before 3.7.3 has unnecessary files such as Lodash files under the web root, which leads to XSS...

CVE-2020-10791: Server-Side Request Forgery (SSRF)

app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests aka SSRF via the Test Connection feature aka testGrafanaConnection of the Grafana Module...

Unspecified vulnerability in openITCOCKPIT

openITCOCKPIT is a set of open source system monitoring tools . openITCOCKPIT 3.7.2 and earlier versions of a security vulnerability , an attacker can be exploited by placing in the HTTP Host header with 'dev' or 'staging' host name configuration self::DEVELOPMENT or self::STAGING option...

CVE-2020-10792

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...

CVE-2020-10792

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...

Design/Logic Flaw

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...

CVE-2020-10792

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...

CVE-2020-10792

OpenITCOCKPIT versions up to 3.7.2 are affected: an attacker can cause DEVELOPMENT or STAGING to be selected by sending a hostname in the HTTP Host header containing dev or staging. Root cause is improper handling of Host header input. Impact is configuration of environment options. For remediati...

CVE-2020-10792: Incorrect Default Permissions

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header...

CVE-2019-10227

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

CVE-2019-10227

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

Cross site scripting

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

CVE-2019-10227

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

CVE-2019-10227

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

CVE-2019-10227

openITCOCKPIT before 3.7.1 is affected by a reflected XSS in the 404-not-found component. The CVE details confirm the issue (XSS) and that a fixed version is 3.7.1. The vulnerability is non-authenticated per CVSS2/3.1 vectors, with impact to integrity. Publicly documented remediation is upgrading...

CVE-2019-10227: Improper Neutralization of Input During Web Page Generation

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...

openITCOCKPIT Code Injection Vulnerability

openITCOCKPIT is a set of open source system monitoring tools . A code injection vulnerability exists in versions of openITCOCKPIT prior to 3.7.1. The vulnerability arises from external input data to construct code segments in the process , the network system or product is not properly filtered f...

openITCOCKPIT Cross-Site Scripting Vulnerability

openITCOCKPIT is a set of open source system monitoring tools . openITCOCKPIT 3.7.1 before the version of the cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the client data to the correct validation , an attacker can exploit the vulnerability to...

openITCOCKPIT Cross-Site Request Forgery Vulnerability

openITCOCKPIT is a set of open source system monitoring tools . A cross-site request forgery vulnerability exists in versions prior to openITCOCKPIT 3.7.1. An attacker can exploit this vulnerability to send unintended requests to the server via an affected client...