Cockpit
Monthly
Unauthenticated remote connection flooding against the cockpit-tls front-end of Cockpit (the TLS terminator for the Cockpit web console, default TCP 9090) forces the service to spawn an unbounded number of detached threads, exhausting memory and file descriptors until the console degrades or becomes unavailable. The flaw, tracked as CWE-770 (allocation of resources without limits or throttling), carries a 7.5 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects Cockpit as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat OpenShift Dev Spaces; the CVSS vector confirms the attack needs no authentication or user interaction. Exploitation is bounded to availability of the management console rather than the underlying host services, CISA's SSVC assessment records Exploitation: none (automatable: yes, technical impact: partial), and no public exploit code was identified at time of analysis. Because the primitive is simply 'open many concurrent TCP connections,' it is highly automatable and becomes a practical risk anywhere port 9090 is reachable from an untrusted network.
Arbitrary file disclosure and PHP local file inclusion in Cockpit CMS before release 364 lets unauthenticated remote attackers read files outside the web root and, on certain server setups, cause the application to include() attacker-chosen .php files. The flaw stems from unvalidated PATH_INFO (derived from REQUEST_URI) being used to build filesystem paths without containment checks. Publicly available exploit code exists; it is not listed in CISA KEV and no EPSS score was provided.
Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitrary PHP through the /cockpit/collections/save_collection endpoint's rule parameters, which are persisted to server-side PHP files and executed via include(). A low-privileged authenticated user can therefore run arbitrary OS commands on the host. Publicly available exploit code exists (VulnCheck advisory and a public gist), though this is not listed in CISA KEV; EPSS is modest at 0.39% (60th percentile).
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Man-in-the-middle interception of the cron.php web-worker restart request in Cockpit CMS 2.12.0 through 2.14.0 allows an on-path attacker to steal the worker/web/token value and then start the web worker themselves. The restart request is sent to the configured site_url with TLS peer verification disabled, so any certificate presented on that outbound path is accepted; the attacker must already hold an adjacent/on-path position and must catch a restart in flight, which is why the issue is rated low severity (CVSS 2.3, our assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available in 2.14.1.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
Account enumeration in Cockpit CMS before 2.14.1 exposes valid usernames through measurable response-time differences in the authentication check endpoint. When a submitted username matches an existing account, the application performs a full bcrypt hash comparison - an intentionally slow operation - whereas non-existent accounts return immediately without any hash computation, creating a statistically detectable timing delta. Unauthenticated remote attackers can exploit this by issuing repeated authentication probes and measuring latency, building a list of valid accounts to target with credential stuffing or brute-force attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, though a researcher advisory (MFC-2026-001) exists.
Stored cross-site scripting in Cockpit CMS 2.14.0 and earlier allows authenticated users with content/:models/manage permission to inject arbitrary JavaScript through the Set field type's Display template option. The vulnerability exploits unsafe template rendering via `new Function()` and Vue's v-html directive without sanitization, executing injected code in the browsers of all users viewing the collection items list. Vendor-released patch available via commit 72a83fc replaces Function-based evaluation with sandboxed JSLite execution.
NoSQL injection in Cockpit-HQ Cockpit up to version 2.13.5 allows authenticated remote attackers to manipulate data query logic through the Asset Handler or Aggregate Handler components, resulting in information disclosure with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable.13. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data.251.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An SSRF issue was discovered in cockpit-project.org Cockpit 234. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Agentejo Cockpit 0.10.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cockpit 0.5.5 has XSS via a collection, form, or region. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote connection flooding against the cockpit-tls front-end of Cockpit (the TLS terminator for the Cockpit web console, default TCP 9090) forces the service to spawn an unbounded number of detached threads, exhausting memory and file descriptors until the console degrades or becomes unavailable. The flaw, tracked as CWE-770 (allocation of resources without limits or throttling), carries a 7.5 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects Cockpit as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat OpenShift Dev Spaces; the CVSS vector confirms the attack needs no authentication or user interaction. Exploitation is bounded to availability of the management console rather than the underlying host services, CISA's SSVC assessment records Exploitation: none (automatable: yes, technical impact: partial), and no public exploit code was identified at time of analysis. Because the primitive is simply 'open many concurrent TCP connections,' it is highly automatable and becomes a practical risk anywhere port 9090 is reachable from an untrusted network.
Arbitrary file disclosure and PHP local file inclusion in Cockpit CMS before release 364 lets unauthenticated remote attackers read files outside the web root and, on certain server setups, cause the application to include() attacker-chosen .php files. The flaw stems from unvalidated PATH_INFO (derived from REQUEST_URI) being used to build filesystem paths without containment checks. Publicly available exploit code exists; it is not listed in CISA KEV and no EPSS score was provided.
Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitrary PHP through the /cockpit/collections/save_collection endpoint's rule parameters, which are persisted to server-side PHP files and executed via include(). A low-privileged authenticated user can therefore run arbitrary OS commands on the host. Publicly available exploit code exists (VulnCheck advisory and a public gist), though this is not listed in CISA KEV; EPSS is modest at 0.39% (60th percentile).
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Man-in-the-middle interception of the cron.php web-worker restart request in Cockpit CMS 2.12.0 through 2.14.0 allows an on-path attacker to steal the worker/web/token value and then start the web worker themselves. The restart request is sent to the configured site_url with TLS peer verification disabled, so any certificate presented on that outbound path is accepted; the attacker must already hold an adjacent/on-path position and must catch a restart in flight, which is why the issue is rated low severity (CVSS 2.3, our assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available in 2.14.1.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
Account enumeration in Cockpit CMS before 2.14.1 exposes valid usernames through measurable response-time differences in the authentication check endpoint. When a submitted username matches an existing account, the application performs a full bcrypt hash comparison - an intentionally slow operation - whereas non-existent accounts return immediately without any hash computation, creating a statistically detectable timing delta. Unauthenticated remote attackers can exploit this by issuing repeated authentication probes and measuring latency, building a list of valid accounts to target with credential stuffing or brute-force attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, though a researcher advisory (MFC-2026-001) exists.
Stored cross-site scripting in Cockpit CMS 2.14.0 and earlier allows authenticated users with content/:models/manage permission to inject arbitrary JavaScript through the Set field type's Display template option. The vulnerability exploits unsafe template rendering via `new Function()` and Vue's v-html directive without sanitization, executing injected code in the browsers of all users viewing the collection items list. Vendor-released patch available via commit 72a83fc replaces Function-based evaluation with sandboxed JSLite execution.
NoSQL injection in Cockpit-HQ Cockpit up to version 2.13.5 allows authenticated remote attackers to manipulate data query logic through the Asset Handler or Aggregate Handler components, resulting in information disclosure with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable.13. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data.251.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An SSRF issue was discovered in cockpit-project.org Cockpit 234. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Agentejo Cockpit 0.10.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cockpit 0.5.5 has XSS via a collection, form, or region. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.