← Back

Cockpit

cockpit

Vendor: Cockpit Project • 4 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-3698
2Cockpit Project
Redhat
2Cockpit
Enterprise Linux
Jun 17, 2026
Mar 10, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate succes...Show more
A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.Show less
CVE-2021-3660
2Cockpit Project
Redhat
2Cockpit
Enterprise Linux
Jun 17, 2026
Mar 10, 2022
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious webs...Show more
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.Show less
CVE-2020-35850
1Cockpit Project
1Cockpit
Jun 17, 2026
Dec 30, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think [it] is a big real-life issue.
CVE-2019-3804
3Cockpit Project
FedoraprojectRedhat
3Cockpit
FedoraVirtualization
Jun 17, 2026
Mar 26, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid...Show more
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.Show less