Agentejo: >> Cockpit >> 0.6.0 Security Vulnerabilities
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
CVSS Score
7.2
EPSS Score
0.001
Published
2023-03-10
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
CVSS Score
4.0
EPSS Score
0.001
Published
2023-03-03
Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
CVSS Score
6.1
EPSS Score
0.005
Published
2023-02-21
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
CVSS Score
4.0
EPSS Score
0.002
Published
2023-02-11
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
CVSS Score
5.3
EPSS Score
0.0
Published
2023-02-09
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.
CVSS Score
9.8
EPSS Score
0.007
Published
2022-08-15
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
CVSS Score
8.6
EPSS Score
0.003
Published
2022-08-08
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.
CVSS Score
9.8
EPSS Score
0.853
Published
2021-01-08
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
CVSS Score
9.8
EPSS Score
0.935
Published
2020-12-30
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
CVSS Score
9.8
EPSS Score
0.939
Published
2020-12-30