Product:

Cockpit

(Agentejo)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 27
Date Id Summary Products Score Patch Annotated
2023-07-20 CVE-2023-37649 Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. Cockpit 7.5
2023-07-20 CVE-2023-37650 A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. Cockpit 8.8
2023-03-10 CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Cockpit 8.8
2023-03-03 CVE-2023-1160 Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. Cockpit 5.5
2023-02-21 CVE-2021-32857 Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue. Cockpit 6.1
2023-02-11 CVE-2023-0780 Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. Cockpit 5.4
2023-02-09 CVE-2023-0759 Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Cockpit 8.8
2020-12-30 CVE-2020-35846 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Cockpit 9.8
2018-04-10 CVE-2017-14611 SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component. Cockpit 9.1
2022-08-08 CVE-2022-2713 Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Cockpit 9.8