PYSEC-2020-227

All versions of package cabot are vulnerable to Cross-site Scripting XSS via the Endpoint column...

CVE-2020-7734 Cross-site Scripting (XSS)

All versions of package cabot are vulnerable to Cross-site Scripting XSS via the Endpoint column...

CVE-2020-7734

CVE-2020-7734 – Cabot XSS (Endpoint column) Multiple sources (GHSA-MQWH-R366-4224, OSV, NVD) confirm that the Python package cabot is vulnerable to Cross-site Scripting via the Endpoint column. Affected versions include all versions up to 0.11.16 per the advisory, with broader phrasing indicating...

Cabot 0.11.12 Cross Site Scripting

Exploit Title: Cabot 0.11.12 - Persistent Cross-Site Scripting Date: 2020-09-06 Exploit Author: Abhiram V Vendor Homepage: https://cabotapp.com/ Software Link: https://github.com/arachnys/cabot Version: 0.11.12 Tested on: Ubuntu Linux Introduction Cabot is a free, open-source, self-hosted...

Cabot 0.11.12 - Persistent Cross-Site Scripting

Exploit Title: Cabot 0.11.12 - Persistent Cross-Site Scripting Date: 2020-09-06 Exploit Author: Abhiram V Vendor Homepage: https://cabotapp.com/ Software Link: https://github.com/arachnys/cabot Version: 0.11.12 Tested on: Ubuntu Linux Introduction Cabot is a free, open-source, self-hosted...

Cross-site Scripting (XSS)

Overview cabot is a Self-hosted, easily-deployable monitoring and alerts service - like a lightweight PagerDuty Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Endpoint column. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...

Cross-site Scripting (XSS) - Stored in arachnys/cabot

Description Executed Persistent stored XSS in cabot check settings, as well as the address field. As per CVEs present Stored XSS is a High Severity bug. Proof of Concept 1. setup cabot to reproduce the vulnerability 2. create an account now login to the account 3. Go to checks Create and navigate...