Aheinze

The issue is related to Cross-site Scripting (XSS) - Reflected in the GitHub repository cockpit-hq/cockpit. A patch is available and is anticipated to be part of version 2.6.4.

The issue is related to Cross-site Scripting (XSS) - Stored in the GitHub repository cockpit-hq/cockpit. This type of attack occurs when an application stores user input data without proper validation and then displays it to other users, allowing an attacker to inject malicious scripts into the application.

The issue is related to Cross-site Scripting (XSS) - Reflected in the GitHub repository cockpit-hq/cockpit. This type of attack occurs when an application includes user input in its response without properly validating or encoding it, allowing an attacker to inject malicious scripts into the application.

The issue is related to a Cross-site Scripting (XSS) - Stored vulnerability in the cockpit-hq/cockpit GitHub repository. This vulnerability exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an XSS attack. For any role that has permission to execute function assets, an attacker can upload an HTML file, leading to XSS.

The issue is related to improper restriction of rendered UI layers or frames.

The issue concerns a Privilege Chaining problem in the GitHub repository cockpit-hq/cockpit.

O problema diz respeito à remoção inadequada de informações confidenciais antes do armazenamento ou da transferência e também envolve uma violação da autenticação de dois fatores (2FA). O segredo da 2FA é divulgado em um token JWT após o usuário fazer login em sua conta, permitindo que um invasor contorne o código da 2FA.

A vulnerabilidade permite a injeção NoSQL por meio da função `newpassword` no arquivo `Controller/Auth.php`.