Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
120 results · page 3 of 3
Mar 11, 2020A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1.CVE-2019-5107 · Other software · Wago · reported by talos-cna@cisco.comHigh 7.5
A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or destined for e!Cockpit. This includes passwords, configurations, and binaries being transferred to endpoints.
- Product
- WAGO e!Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 11, 2020A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1.CVE-2019-5106 · Other software · Wago · reported by talos-cna@cisco.comMedium 5.5
A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text.
- Product
- WAGO e!Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 6, 2020An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the serveCVE-2020-6856 · Other software · Sos-berlin · reported by MITREMedium 6.5
An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.
- Product
- Jobscheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchange.sos-berlin.comchange.sos-berlin.com
Feb 6, 2020A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a CVE-2020-6855 · Other software · Sos-berlin · reported by MITREMedium 6.5
A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service.
- Product
- Jobscheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchange.sos-berlin.comchange.sos-berlin.com
Feb 5, 2020A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HCVE-2020-6854 · Other software · Sos-berlin · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API.
- Product
- Jobscheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchange.sos-berlin.comchange.sos-berlin.com
Dec 31, 2019openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-10227 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenitcockpit.ioopenitcockpit.io
Aug 23, 2019openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.CVE-2019-15494 · Other software · It-novum · reported by MITRECritical 9.8
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.CVE-2019-15493 · Other software · It-novum · reported by MITREHigh 7.5
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.CVE-2019-15492 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.CVE-2019-15491 · Other software · It-novum · reported by MITREHigh 8.8
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.CVE-2019-15490 · Other software · It-novum · reported by MITRECritical 9.8
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2019During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` wCVE-2019-10139 · Other software · ovirt · reported by Red HatHigh 7.8
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
- Product
- cockpit-ovirt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Mar 26, 2019It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack.CVE-2019-3804 · Other software · [UNKNOWN] · reported by Red HatHigh 7.5
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
- Product
- cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 15, 2018Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations aCVE-2018-15540 · Other software · Agentejo · reported by MITRECritical 9.8
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 15, 2018Agentejo Cockpit lacks an anti-CSRF protection mechanism.CVE-2018-15539 · Other software · Agentejo · reported by MITREHigh 8.8
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 15, 2018Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.CVE-2018-15538 · Other software · Agentejo · reported by MITREMedium 6.1
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 25, 2018Cockpit 0.5.5 has XSS via a collection, form, or region.CVE-2018-11471 · Other software · Getcockpit · reported by MITREMedium 5.4
Cockpit 0.5.5 has XSS via a collection, form, or region.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2018SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic CVE-2018-9302 · Other software · Getcockpit · reported by MITRECritical 9.1
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgexploit-db.com
Apr 10, 2018SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameterCVE-2017-14611 · Other software · Agentejo · reported by MITRECritical 9.1
SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 18, 2014The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote CVE-2014-1861 · Other software · Jetroplatforms · reported by MITREHigh 9.3
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
- Product
- Jetro Cockpit Secure Browsing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comblog.quaji.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.