Prototype Pollution

cockpit-hq/cockpit is vulnerable to Prototype Pollution. The vulnerability exists due to the use of lodash 4.17.15 which is a platform dependent third party component which allows an attacker to inject properties into existing construct prototypes and modify attributes...

CVE-2023-1313

CVE-2023-1313 affects cockpit-hq/cockpit prior to 2.4.1. The root cause is a lack of extension checking during file uploads, allowing unrestricted uploads of files with dangerous types. This can enable remote code execution on vulnerable servers as described in multiple connected sources. The iss...

CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

CVE-2023-1160 Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0...

Clickjacking

cockpit-hq is vulnerable to Clickjacking. The vulnerability exists due to the lack of the x-frame-options header in admin.php which allows an attacker to misdirect the user, making them click something unintentionally...

Privilege Escalation

cockpit-hq is vulnerable to Privilege Escalation. The vulnerability exists in the save function of Users.php, allowing an attacker to escalate a user role by intercepting the request and modifying the POST data...

CVE-2023-0780

Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev...

CVE-2023-0780 Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit

Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev...

CVE-2023-0759

CVE-2023-0759 affects Cockpit (cockpit-hq/cockpit) prior to version 2.3.8. The issue is described as a Privilege Chaining vulnerability, with disclosures and advisories consistently noting a fix in 2.3.8 or later. MITRE/attack details are not provided in the connected documents, and there is no e...

CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...

CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...

CVE-2023-0759 Privilege Chaining in cockpit-hq/cockpit

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8...

Security Bulletin: TADDM affected by multiple vulnerabilities due to JRuby and Hyperic HQ

Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service due to use of JRuby CVE-2011-4838 and cross site scripting due to use of Hyperic HQ CVE-2009-2907, CVE-2009-2899 Vulnerability Details CVEID:CVE-2009-2907 DESCRIPTION: Hyperic HQ is vulnerable to...

Insufficient Session Expiration

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

CVE-2022-2713

Cockpit (cockpit-hq/cockpit) before version 2.2.0 is vulnerable to Insufficient Session Expiration. Multiple connected sources describe an access control/session handling issue where expired sessions can be exploited, potentially allowing an attacker to take control of an account. Root cause cite...

CVE-2022-2713 Insufficient Session Expiration in cockpit-hq/cockpit

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

MAL-2022-454 Malicious code in @nerv-hq/control-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a7e7877cb0a7188b9fdc4feb0645afa1aa7cd1998ce9a61e3c170eb714cf35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nerv-hq/control-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a7e7877cb0a7188b9fdc4feb0645afa1aa7cd1998ce9a61e3c170eb714cf35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...