it-novum openITCOCKPIT any version

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.

openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.

openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.

openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.

openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion

openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling

openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header.

openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.

openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection

app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.

Race Condition within a Thread in it-novum/openitcockpit

openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.

openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.

openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit