Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2014-3225

cobbler: local file inclusion over remote installs

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

CVSS 2.0 · 4.0 Medium EPSS 8.9% KEV · Not listed
Vendors
Cobblerd
Products
Cobbler
CVE-2018-1000226

cobbler: XMLRPC API endpoints are not correctly validating security tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

CVSS 3.0 · 9.8 Critical EPSS 12.6% KEV · Not listed
Vendors
Cobblerd
Products
Cobbler
CVE-2018-1000225

cobbler: Persistent XSS vulnerability in cobbler-web

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).

CVSS 3.0 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Cobblerd
Products
Cobbler
CVE-2011-4954

cobbler: Local privilege escalation due use of insecure (world writable) location for PYTHON_EGG_CACHE cache

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Cobblerd
Products
Cobbler
CVE-2011-4952

(cobbler-web): Absent CSRF protection when using Django framework

cobbler: Web interface lacks CSRF protection when using Django framework

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cobblerd
Products
Cobbler