Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2016-3728

foreman: Missing input validation in Smart Proxy allows RCE via TFTP file variant parameter

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-3693

foreman: inspect in a provisioning template exposes sensitive controller information

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

CVSS 3.0 · 8.1 High EPSS 2.1% KEV · Not listed
Vendors
Redhat Safemode Project
Products
Satellite Satellite Capsule Safemode
CVE-2016-3097

spacewalk-java: Multiple XSS flaws

Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via a group name, related to viewing snapshot data.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2016-3080

spacewalk-monitoring: XSS issue in monitoring probe

Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via the (1) RHNMD User or (2) Filesystem parameters, related to display of monitoring probes.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2016-3079

spacewalk-java: Multiple XSS issues in WebUI

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).

CVSS 3.0 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite Spacewalk-java
CVE-2016-3072

Katello: Authenticated sql injection via sort_by and sort_order request parameter

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Katello Redhat
Products
Katello Enterprise Linux Satellite
CVE-2016-2166

qpid-proton: reactor sends messages in clear if ssl is requested but not available

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

CVSS 3.0 · 6.5 Medium EPSS 4.3% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Qpid Proton Fedora Satellite and 1 more
CVE-2016-2103

5: multiple stored XSS vulnerabilities

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2) unspecified vectors involving systems/VirtualSystemsList.do.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2016-2100

foreman: Unprivileged user can access private bookmarks of other users

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2012-6619

mongodb: memory over-read via incorrect BSON object length

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

CVSS 2.0 · 6.4 Medium EPSS 3.9% KEV · Not listed
Vendors
Mongodb Redhat
Products
Mongodb Enterprise Mrg Openstack and 2 more
CVE-2013-1869

Satellite/Spacewalk: header injection flaw

CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via the return_url parameter.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite Spacewalk-java
CVE-2016-1669

V8: integer overflow leading to buffer overflow in Zone::New

The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2015-0223

qpid-cpp: anonymous access to qpidd cannot be prevented

Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.

CVSS 2.0 · 5.0 Medium EPSS 6.6% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg Satellite and 1 more
CVE-2016-0376

JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

CVSS 3.0 · 8.1 High EPSS 5.7% KEV · Not listed
Vendors
Ibm Novell Redhat
Products
Java Sdk Suse Linux Enterprise Module For Legacy Software Suse Linux Enterprise Server and 12 more
CVE-2014-7812

Spacewalk: XSS in system-group

Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to inject arbitrary web script or HTML via the System Groups field.

CVSS 2.0 · 3.5 Low EPSS 1.5% KEV · Not listed
Vendors
Redhat Suse
Products
Network Satellite Satellite Spacewalk and 1 more
CVE-2010-2236

Proxy: Improper monitoring probes input sanitization (ACE)

The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks.

CVSS 2.0 · 6.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat
Products
Network Proxy Satellite Spacewalk-java
CVE-2016-0363

JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.

CVSS 3.0 · 8.1 High EPSS 4.0% KEV · Not listed
Vendors
Ibm Novell Redhat
Products
Java Sdk Suse Linux Enterprise Module For Legacy Software Suse Linux Enterprise Server and 12 more
CVE-2015-1816

foreman: lack of SSL certificate validation when performing LDAPS authentication

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.

CVSS 2.0 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2014-3691

foreman-proxy: failure to verify SSL certificates

Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat Theforeman
Products
Openstack Openstack-installer Satellite and 2 more