Most recent entries from all

cnvd-2022-18329

EUVD-2026-31131

fkie_cve-2021-40323

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

GHSA-cpqf-3c3r-c9g2 — Cobbler before 3.3.0 allows log poisoning

Affected: PyPI: cobbler

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

gsd-2021-40323

OESA-2025-1467 — cobbler security update

Affected: openEuler:22.03-LTS-SP3: cobbler

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, &apos;koan&apos;, that integrates with cobbler. Cobbler&apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications. Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation…

PYSEC-2021-373

Affected: PyPI: cobbler

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

SUSE-RU-2021:3162-1 — Recommended update for SUSE Manager 4.2.2 Release Notes

Recommended update for SUSE Manager 4.2.2 Release Notes

UBUNTU-CVE-2021-40323

Affected: Ubuntu:Pro:16.04:LTS: cobbler

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

WID-SEC-W-2023-2927 — cobbler: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cobbler ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.