It Novum
Products
1- 17 CVEs
Recent CVEs
17| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-15494 | Cri | 0.64 | 9.8 | 0.02 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21. | ||
| CVE-2019-15490 | Cri | 0.64 | 9.8 | 0.02 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. | ||
| CVE-2026-24893 | Hig | 0.57 | 8.8 | 0.01 | Apr 14, 2026 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary… | ||
| CVE-2019-15491 | Hig | 0.57 | 8.8 | 0.01 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21. | ||
| CVE-2026-24891 | Hig | 0.49 | 7.5 | 0.00 | Feb 20, 2026 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls… | ||
| CVE-2019-15493 | Hig | 0.49 | 7.5 | 0.01 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21. | ||
| CVE-2019-10227 | Med | 0.43 | 6.1 | 0.01 | Dec 31, 2019 | openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component. | ||
| CVE-2019-15492 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21. | ||
| CVE-2026-24892 | Hig | 0.00 | 7.5 | 0.01 | Feb 20, 2026 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized… | ||
| CVE-2023-3520 | Med | 0.00 | 4.6 | 0.00 | Jul 6, 2023 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6. | ||
| CVE-2023-36663 | Hig | 0.00 | 8.8 | 0.01 | Jun 25, 2023 | it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface. | ||
| CVE-2023-3218 | Med | 0.00 | 4.4 | 0.00 | Jun 13, 2023 | Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5. | ||
| CVE-2020-10788 | Cri | 0.00 | 9.1 | 0.02 | Mar 25, 2020 | openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections. | ||
| CVE-2020-10791 | Med | 0.00 | 6.5 | 0.01 | Mar 25, 2020 | app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module. | ||
| CVE-2020-10790 | Med | 0.00 | 5.4 | 0.01 | Mar 25, 2020 | openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS. | ||
| CVE-2020-10789 | Cri | 0.00 | 9.8 | 0.02 | Mar 25, 2020 | openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php. | ||
| CVE-2020-10792 | Hig | 0.00 | 7.5 | 0.02 | Mar 20, 2020 | openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header. |
- risk 0.64cvss 9.8epss 0.02
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
- risk 0.64cvss 9.8epss 0.02
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
- risk 0.57cvss 8.8epss 0.01
openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary…
- risk 0.57cvss 8.8epss 0.01
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
- risk 0.49cvss 7.5epss 0.00
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls…
- risk 0.49cvss 7.5epss 0.01
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
- risk 0.43cvss 6.1epss 0.01
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- risk 0.40cvss 6.1epss 0.01
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- risk 0.00cvss 7.5epss 0.01
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized…
- risk 0.00cvss 4.6epss 0.00
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
- risk 0.00cvss 8.8epss 0.01
it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.
- risk 0.00cvss 4.4epss 0.00
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
- risk 0.00cvss 9.1epss 0.02
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
- risk 0.00cvss 6.5epss 0.01
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.
- risk 0.00cvss 5.4epss 0.01
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
- risk 0.00cvss 9.8epss 0.02
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.
- risk 0.00cvss 7.5epss 0.02
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header.