IDCVSSSummaryLast (major) updatePublished
CVE-2018-15538 4.3
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
30-11-2018 - 16:39 15-10-2018 - 19:29
CVE-2018-15539 6.8
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.
30-11-2018 - 16:52 15-10-2018 - 19:29
CVE-2018-15540 7.5
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.
30-11-2018 - 16:51 15-10-2018 - 19:29
CVE-2020-35848 7.5
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
31-12-2020 - 19:47 30-12-2020 - 01:15
CVE-2020-35846 7.5
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
21-04-2021 - 17:15 30-12-2020 - 01:15
CVE-2020-35847 7.5
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
21-04-2021 - 17:15 30-12-2020 - 01:15
CVE-2020-35131 7.5
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.
12-01-2021 - 19:46 08-01-2021 - 17:15
Back to Top Mark selected
Back to Top