RSS   Podatności dla 'Cockpit'   RSS

2021-01-08
 
CVE-2020-35131

CWE-94
 
 
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.

 
2020-12-30
 
CVE-2020-35848

CWE-89
 
 
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

 
 
CVE-2020-35847

CWE-89
 
 
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

 
 
CVE-2020-35846

CWE-89
 
 
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

 
2020-06-17
 
CVE-2020-14408

CWE-79
 
 
An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.

 
2018-10-15
 
CVE-2018-15540

CWE-22
 
 
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.

 
 
CVE-2018-15539

CWE-352
 
 
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.

 
 
CVE-2018-15538

CWE-79
 
 
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.

 

Copyright 2024, cxsecurity.com

 

Back to Top