CVSS: 9.8EPSS: 23%CPEs: 4EXPL: 0CVE-2018-10931 – cobbler: CobblerXMLRPCInterface exports all its methods over XMLRPC
https://notcve.org/view.php?id=CVE-2018-10931
09 Aug 2018 — It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon. Se ha descubierto que cobbler 2.6.x exponía todas las funciones desde su clase CobblerXMLRPCInterface mediante XMLRPC. Un atacante no autenticado remoto podría emplear este error para obtener privilegios elevados en cobbler o subir archivos a ubic... • https://access.redhat.com/errata/RHSA-2018:2372 • CWE-749: Exposed Dangerous Method or Function •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2017-1000469
https://notcve.org/view.php?id=CVE-2017-1000469
03 Jan 2018 — Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user. Cobbler, en versiones hasta la 2.8.2, es vulnerable a inyección de comandos en el componente "add repo". Esto resulta en la ejecución de código arbitrario como usuario root. • https://github.com/cobbler/cobbler/issues/1845 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4953
https://notcve.org/view.php?id=CVE-2011-4953
27 Oct 2014 — The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet. La función set_mgmt_parameters en item.py en cobbler anterior a 2.2.2 permite a atacantes dependientes de contexo ejecutar código arbitrario a través de vectores relacionados con el uso de la función yaml.load en lugar de la función yaml.safe_load, tal y c... • http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 6%CPEs: 7EXPL: 5CVE-2014-3225 – Cobbler 2.4.x < 2.6.x - Local File Inclusion
https://notcve.org/view.php?id=CVE-2014-3225
13 May 2014 — Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile. Vulnerabilidad de recorrido de directorio absoluto en la interfaz web en Cobbler 2.4.x hasta 2.6.x permite a usuarios remotos autenticados leer archivos arbitrarios a través del campo Kickstart en un perfil. It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. A... • https://packetstorm.news/files/id/126607 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2012-2395 – cobbler: command injection flaw in the power management XML-RPC API
https://notcve.org/view.php?id=CVE-2012-2395
16 Jun 2012 — Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API. Vulnerabilidad de lista negra incompleta en action_power.py de Cobbler 2.2.0. Permite a atacantes remotos ejecutar comandos arbitrarios a través de meta-caracteres de shell en los campos (1) username o (2) password del método power_system method del API xmlrpc. • http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00016.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 59EXPL: 0CVE-2009-5021
https://notcve.org/view.php?id=CVE-2009-5021
09 Dec 2010 — Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password. Cobbler, en versiones anteriores a la 1.6.1, no determina de manera apropiada si una instalación tiene la contraseña por defecto, lo que facilita a los atacantes obtener acceso usando esta contraseña. • http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 1%CPEs: 82EXPL: 0CVE-2010-2235 – (cobbler): Code injection flaw (ACE as root) by processing of a specially-crafted kickstart template file
https://notcve.org/view.php?id=CVE-2010-2235
09 Dec 2010 — template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954. template_api.py en Cobbler, en versiones anteriores a la 2.0.7, como es usado en Red Hat Network Satellite Server y otros productos, n... • http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 80EXPL: 0CVE-2010-4512
https://notcve.org/view.php?id=CVE-2010-4512
09 Dec 2010 — Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable permissions for files and directories. Cobbler en versiones anteriores a la 2.0.4 usa un valor de umask incorrecto, lo que permite a usuarios locales tener un impacto no especificado aprovechando permisos de escritura para todos en ficheros y directorios. • http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 1%CPEs: 42EXPL: 0CVE-2008-6954
https://notcve.org/view.php?id=CVE-2008-6954
12 Aug 2009 — The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules. La interfaz web en Cobbler (CobblerWeb) anterior a v1.29, permite a usuarios autenticados remotamente ejecutar código Python de su elección en cobblerd, mediante la edición de la plantilla "Cheetah kickstart" a los módulos "import Python" arbitrarios. • http://freshmeat.net/projects/cobbler/releases/288374 • CWE-264: Permissions, Privileges, and Access Controls •