Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2018-16861

foreman: stored XSS in success notification after entity creation

A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-16470

rubygem-rack: Buffer size in multipart parser allows for denial of service

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Rack Project Redhat
Products
Rack Satellite Satellite Capsule
CVE-2018-14664

foreman: Persisted XSS on all pages that use breadcrumbs

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

CVSS 3.0 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-14643

smart_proxy_dynflow: Authentication bypass in Foreman remote execution feature

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-14623

katello: SQL inject in errata-related REST API

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2018-11751

puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Server Satellite Satellite Capsule
CVE-2018-10917

pulp: Improper path parsing leads to overwriting of iso repositories

pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

CVSS 3.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Rhui Satellite and 1 more
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-1000632

dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Dom4j Project Netapp and 2 more
Products
Debian Linux Dom4j Oncommand Workflow Automation and 14 more
CVE-2018-1000119

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

CVSS 3.0 · 5.9 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Sinatrarb
Products
Enterprise Linux Satellite Satellite Capsule and 1 more
CVE-2017-7536

hibernate-validator: Privilege escalation when running under the security manager

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hibernate Validator Jboss Amq and 6 more
CVE-2017-2672

foreman: Image password leak

A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2017-2667

rubygem-hammer_cli: no verification of API server's SSL certificate

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Hammer Cli
CVE-2017-2662

foreman: Managing repositories with their id via hammer does not respect the role filters

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2017-15699

Interconnect: Denial of Service vulnerability in Red Hat JBoss AMQ Interconnect

A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Dispatch Satellite Satellite Capsule
CVE-2017-12175

6: XSS in discovery rule filter autocomplete functionality

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

CVSS 3.0 · 3.5 Low EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2017-10690

puppet: Environment leakage in puppet-agent

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Puppet Enterprise Satellite and 1 more
CVE-2016-9595

katello-debug: Possible symlink attacks due to use of predictable file names

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2016-9593

foreman-debug: missing obfuscation of sensitive information

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-8639

foreman: Stored XSS via organization/location with HTML in name

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman