Filtered by vendor Agentejo
Subscriptions
Total
27 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-35848 | 1 Agentejo | 1 Cockpit | 2022-04-05 | 9.8 Critical |
| Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. | ||||
| CVE-2020-35847 | 1 Agentejo | 1 Cockpit | 2022-04-05 | 9.8 Critical |
| Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. | ||||
| CVE-2020-35131 | 1 Agentejo | 1 Cockpit | 2021-01-12 | 9.8 Critical |
| Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. | ||||
| CVE-2020-14408 | 1 Agentejo | 1 Cockpit | 2020-06-23 | 6.1 Medium |
| An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector. | ||||
| CVE-2018-15539 | 1 Agentejo | 1 Cockpit | 2018-11-30 | N/A |
| Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc. | ||||
| CVE-2018-15540 | 1 Agentejo | 1 Cockpit | 2018-11-30 | N/A |
| Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal. | ||||
| CVE-2018-15538 | 1 Agentejo | 1 Cockpit | 2018-11-30 | N/A |
| Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities. | ||||