Lucene search
+L

531 matches found

Kitploit
Kitploit
added 2026/08/27 5:45 a.m.2 views

CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC

CVE-2024-47533 - Cobbler XMLRPC प्रमाणीकरण बाईपास RCE शोषण ⚠️ Cobbler में प्रमाणीकरण बाईपास के माध्यम से गंभीर रिमोट कोड निष्पादन 🛠️ @dollarboysushil द्वारा PoC कार्यान्वयन 💡 अवलोकन Cobbler, एक Linux स्थापना सर्वर जो नेटवर्क स्थापना वातावरण के त्वरित सेटअप को सक्षम करता है, में संस्करण 3.0.0 से...

9.8CVSS8.6AI score0.04003EPSS
SaveExploits6References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.69 views

Cobbler 'XML-RPC' - Authentication Bypass

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

9.8CVSS8.4AI score0.04003EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.121 views

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

9.8CVSS8.5AI score0.12484EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/08/27 3:16 a.m.3 views

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC 인증 우회 익스플로잇 📜 설명 CVE-2024-47533은 네트워크 기반 OS 설치를 자동화하는 Linux 설치 서버인 Cobbler의 치명적인 인증 우회 취약점 입니다. 이 결함은 utils.getsharedsecret의 문제로 인해 발생하며, 이 함수는 항상-1을 반환하여 Cobbler XML-RPC API에 대한 인증되지 않은 접근을 가능하게 합니다. 공격자는 다음 자격 증명으로 연결할 수 있습니다: 사용자 이름: "" 빈 문자열 비밀번호: -1 이를 통해 배포판...

9.8CVSS8.6AI score0.04003EPSS
SaveExploits6References1
Kitploit
Kitploit
added 2026/08/26 11:21 p.m.3 views

CVE-2024-47533

CVE-2024-47533 - Эксплойт RCE с обходом аутентификации XMLRPC в Cobbler Критическое удалённое выполнение кода через обход аутентификации в Cobbler Реализация PoC. Краткое описание Cobbler, сервер установки Linux, обеспечивающий быструю настройку сетевых установочных сред, имеет уязвимость...

9.8CVSS8.5AI score0.04003EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/26 10:00 p.m.2 views

CVE-2024-47533-PoC

CVE-2024-47533 – Bypass autenticazione Cobbler XMLRPC → Reverse Shell RCE non autenticato 📌 Riepilogo Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2024-47533 , un bypass critico dell'autenticazione nell'API XMLRPC di Cobbler che porta a esecuzione remota di codice RCE non...

9.8CVSS8.5AI score0.04003EPSS
SaveExploits6References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.94 views

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

9.8CVSS8.3AI score0.86829EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/06 8:03 a.m.8 views

PYSEC-2026-792 Cobbler subject to Command Injection

A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

7.5CVSS7.5AI score0.05601EPSS
SaveExploits1References13
OSV
OSV
added 2026/07/06 8:03 a.m.11 views

PYSEC-2026-794 Cobbler is vulnerable to code injection

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

8.5CVSS6.4AI score0.03327EPSS
SaveExploits0References9
OSV
OSV
added 2026/07/06 8:03 a.m.9 views

PYSEC-2026-793 Cobbler vulnerable to code injection via unsafe YAML loading

The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...

6.8CVSS7.2AI score0.02174EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/06 8:03 a.m.10 views

PYSEC-2026-795 Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...

9CVSS6.3AI score0.02145EPSS
SaveExploits0References11
OSV
OSV
added 2026/07/06 8:03 a.m.11 views

PYSEC-2026-797 Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...

4CVSS6.1AI score0.08809EPSS
SaveExploits3References15
PyPA
PyPA
added 2026/07/06 8:03 a.m.12 views

Cobbler XSS Vulnerability

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting XSS vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to...

6.1CVSS6.8AI score0.01262EPSS
SaveExploits0References7Affected Software1
OSV
OSV
added 2026/07/06 8:03 a.m.9 views

PYSEC-2026-796 Cobbler XSS Vulnerability

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting XSS vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to...

6.1CVSS5.9AI score0.01262EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/02 2:13 p.m.9 views

PYSEC-2026-623 Cobbler Arbitrary File Read

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...

6.1CVSS6AI score0.00799EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/02 2:13 p.m.8 views

PYSEC-2026-624 Cobbler Web Interface Lacks CSRF Protection

cobbler: Web interface lacks CSRF protection when using Django framework...

8.8CVSS6AI score0.0063EPSS
SaveExploits0References10
PyPA
PyPA
added 2026/06/29 11:50 a.m.12 views

cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Summaryutils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Detailsutils.py getsharedsecret:def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree on...

9.8CVSS7.1AI score0.04003EPSS
SaveExploits6References7Affected Software1
OSV
OSV
added 2026/06/29 11:50 a.m.16 views

PYSEC-2026-316 cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Summary utils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Details utils.py getsharedsecret: def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree o...

9.8CVSS7.3AI score0.04003EPSS
SaveExploits6References7
PyPA
PyPA
added 2026/06/29 11:50 a.m.11 views

Cobbler has Exposed Dangerous Method or Function

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

9.8CVSS7.2AI score0.68083EPSS
SaveExploits0References16Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

9.8CVSS7.1AI score0.12484EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder