repository icon
cockpit-hq / cockpit Project repository

Cockpit Core - Content Platform

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN36 DAYS

FIX

WITHIN14 DAYS

File Upload Bypass Leads to Stored XSS
5h4s1
duplicate
High
Reflected XSS via pdf upload
popcorn94
not applicable
stored xss in asset upload file
nyeooo
self closed
Reflected xss in installation space parameter
j0x1nx
Medium
•CVE-2023-4451
Cross-site Scripting (XSS) - Reflected
5h4s1
High
•CVE-2023-4432
File Upload Bypass Leads to Stored XSS
1dayluo
High
•CVE-2023-4395
STORED XSS in File Upload
nyeooo
High
•CVE-2023-4433
File Upload Bypass Leads to Stored XSS
5h4s1
High
•CVE-2023-4321
Stored XSS Vulnerability in Display Name
cupc4k3
pending
MIME Sniffing: Able to upload XSS payload with any extension name
akshayravic09yc47
not applicable
Stored XSS via asset upload
akshayravic09yc47
not applicable
Cross-site Scripting (Stored XSS)
quanghuy25112000
High
•CVE-2023-4196
File Upload Bypass Leads to Remote Code Execution (RCE)
quanghuy25112000
Critical
•CVE-2023-4195
Unrestricted Upload of File with Dangerous Type Leads to Remote Code Execution (...
liteshghute
not applicable
RCE in file upload functionality due to incomplete fix for CVE-2023-1313.
tsarsecurity
not applicable
Arbitrary File Read Write and Delete at Finder Module
choocs
not applicable
Cross Site Scripting (XSS) in Assets
choocs
Medium
•CVE-2023-4422
Insufficient Upload Filtering leads to RCE
choocs
self closed
File Upload Bypass Leads to Remote Code Execution (RCE)
choocs
High
•CVE-2023-1313
Lodash 4.17.15 in use which is vulnerable to CVE-2020-8203
popcorn94
Medium
•CVE-2023-1160
Authenticated Unrestricted File Upload with Remote Code Execution or XSS
popcorn94
pending
Stored xss via pdf upload
govindpalakkal
pending
Vulnerable to clickjacking
popcorn94
Medium
•CVE-2023-0780
Session cookie without HTTPOnly and Secure Flag
popcorn94
not applicable
Privilege Escalation in the Cockpit CMS
cupc4k3
Medium
•CVE-2023-0759
Exposure of Sensitive Information to an Unauthorized Actor
whoisshuvam
not applicable
2FA Bypass in Cockpit Content Platform ≤ v2.2.1
whoisshuvam
Critical
•CVE-2022-2818
Insufficient Session Expiration After Password Change
whoisshuvam
High
•CVE-2022-2713