Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the start meeting API endpoint when the size of the request body is not limited. An attacker can exhaust system resources or disrupt service availability by sending crafted...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the processing of malicious JSON payloads in the request handling process. An attacker can exhaust system memory and CPU resources by sending specially crafted JSON objects that, when deserialized, consume...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter. PoC php " document.getElementById"cmd".focus; Remediation Upgrade cockpit-hq/cockpit to version 2.4.1 or higher. References - GitHub Commit...