cockpit-hq/cockpit (Packagist)
Advisories
26
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.14.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require cockpit-hq/cockpit:^2.14.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-ch4j-vcf5-58x5 Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option |
Medium EPSS 0.14% |
<= 2.14.0 | No fix yet |
| GHSA-p46p-7pmj-m34f Cockpit is vulnerable to directory traversal |
Medium EPSS 0.84% |
< 2.14.0 | 2.14.0 |
| GHSA-j2rx-4jg9-79mw Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type |
High EPSS 0.38% |
< 2.14.0 | 2.14.0 |
| GHSA-fm6c-rhcf-7439 Cockpit is vulnerable to arbitrary code execution |
Critical EPSS 0.43% |
< 2.14.0 | 2.14.0 |
| GHSA-5pv2-86qj-5jf9 Cockpit has NoSQL Injection Through Content Aggregation Pipelines |
Medium EPSS 0.23% |
< 2.14.0 | 2.14.0 |
| GHSA-7x5c-vfhj-9628 Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() |
Medium EPSS 0.40% |
< 2.13.5 | 2.13.5 |
| GHSA-j4rj-fgcq-wmqp Cockpit - Content Platform vulnerable to XSS through name or email argument names |
Medium EPSS 0.35% |
< 2.11.4 | 2.11.4 |
| GHSA-wp68-xrfg-xvq4 Cockpit Arbitrary File Upload |
High EPSS 18.85% |
< 2.4.1 | 2.4.1 |
| GHSA-vpj8-xfqc-jcv9 Cockpit CMS contains an arbitrary file upload vulenrability |
Critical EPSS 0.72% |
< 2.7.0 | 2.7.0 |
| GHSA-q76r-7p4q-mqpw Cockpit CMS Cross-Site Scripting vulnerability |
Medium EPSS 0.32% |
No fix yet | |
| GHSA-38vf-35cg-m73w Cockpit CMS arbitrary file upload vulnerability |
Medium EPSS 0.99% |
<= 2.6.3 | No fix yet |
| GHSA-g3mv-64h3-h482 Cockpit Cross-site Scripting vulnerability |
Medium EPSS 2.48% |
<= 2.6.3 | No fix yet |
| GHSA-ff45-2jp9-69jc Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.56% |
<= 2.6.3 | No fix yet |
| GHSA-rmgx-3w4r-xcfp Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.61% |
<= 2.6.3 | No fix yet |
| GHSA-8m65-qq6g-43rr Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.64% |
< 2.6.3 | 2.6.3 |
| GHSA-5cv4-48h7-7782 Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.57% |
<= 2.6.3 | No fix yet |
| GHSA-3vf5-xm2p-6mh5 Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.64% |
<= 2.6.2 | No fix yet |
| GHSA-w3qm-93vf-5hrw Cockpit Cross-site Scripting vulnerability |
Medium EPSS 0.47% |
< 2.6.3 | 2.6.3 |
| GHSA-xcq3-7pf3-5jvc Cockpit PHP Remote File Inclusion vulnerability |
High EPSS 1.05% |
< 2.6.3 | 2.6.3 |
| GHSA-45g2-r339-pjwf Cockpit CMS Cross-Site Request Forgery vulnerability |
High EPSS 0.53% |
< 2.6.0 | 2.6.0 |
| GHSA-9r25-4j77-9wc7 Cockpit CMS vulnerable to incorrect access control |
High EPSS 0.88% |
< 2.6.0 | 2.6.0 |
| GHSA-6x8f-x6qw-qwx3 cockpit-hq/cockpit is vulnerable to unrestricted file uploads |
High EPSS 0.99% |
< 2.4.1 | 2.4.1 |
| GHSA-p8cq-pv6w-6rwx Cockpit Uses Platform-Dependent Third Party Components |
Medium EPSS 0.35% |
<= 2.3.9 | No fix yet |
| GHSA-gm7m-rqf8-jx4m Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit |
Medium EPSS 0.37% |
< 2.3.9 | 2.3.9 |
| GHSA-86rf-38v8-9c4x privilege chaining in cockpit-hq/cockpit |
High EPSS 0.34% |
< 2.3.8 | 2.3.8 |
| GHSA-8wj3-cpmr-8whp Cockpit Content Platform vulnerable to 2FA bypass |
High EPSS 1.69% |
< 2.2.2 | 2.2.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor