CVE-2020-35131: Improper Control of Generation of Code

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI...

Agentejo Cockpit NoSQL Injection Vulnerability (CNVD-2021-01562)

Agentejo Cockpit is a self-hosted "headless" and api driven lightweight, open source content management system. A NoSQL injection vulnerability exists in Agentejo Cockpit prior to version 0.11.2. The vulnerability can be exploited to conduct NoSQL injection attacks via the Controller/Auth.php che...

httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4

It was discovered that in httpd 2.4, the internal API function apsomeauthrequired could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied...

PT-2013-1267

Name of the Vulnerable Software and Affected Versions libmicrohttpd versions prior to 0.9.32 Description The issue is related to a stack-based buffer overflow in the MHD digest auth check function. This can be triggered when MHD OPTION CONNECTION MEMORY LIMIT is set to a large value, allowing...