Overview · schorschii/OCO-Server · GitHub

Repository navigation

Security

No security policy detected

This project has not set up a SECURITY.md file yet.

Report a vulnerability

MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
GHSA-p549-5h7r-7639 published Sep 29, 2026 by schorschii

Critical
Self-Service Portal: uninstall-job authorization bypass lets a read-only user queue software removal on computers/packages they have no deploy permission on
GHSA-34mv-3gjp-gf53 published Sep 29, 2026 by schorschii

Moderate
Stored XSS via unvalidated agent hostname in default RDP/VNC/SSH/Ping command buttons (onclick JS-string-context escaping bypass)
GHSA-9c2r-9j95-22pr published Jul 23, 2026 by schorschii

High

Learn more about advisories related to schorschii/OCO-Server in the GitHub Advisory Database