Product:

Cockpit

(Agentejo)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 29
Date Id Summary Products Score Patch Annotated
2021-01-08 CVE-2020-35131 Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. Cockpit 9.8
2022-08-08 CVE-2022-2713 Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Cockpit 9.8
2022-08-15 CVE-2022-2818 Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. Cockpit 8.8
2023-02-09 CVE-2023-0759 Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Cockpit 8.8
2023-02-11 CVE-2023-0780 Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. Cockpit 5.4
2023-02-21 CVE-2021-32857 Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue. Cockpit 6.1
2023-03-03 CVE-2023-1160 Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. Cockpit 5.5
2023-03-10 CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Cockpit 8.8
2023-07-20 CVE-2023-37649 Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. Cockpit 7.5
2023-07-20 CVE-2023-37650 A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. Cockpit 8.8