Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2018-1077

spacewalk: XML External Entity (XXE) on Spacewalk APIs

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

CVSS 3.0 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Satellite Spacewalk
CVE-2018-16887

katello: stored XSS in subscriptions and repositories pages

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2018-16861

foreman: stored XSS in success notification after entity creation

A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-16470

rubygem-rack: Buffer size in multipart parser allows for denial of service

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Rack Project Redhat
Products
Rack Satellite Satellite Capsule
CVE-2018-14666

Satellite: Smart class parameters allow users to access other organizations

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.

CVSS 3.0 · 6.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Satellite
CVE-2018-14664

foreman: Persisted XSS on all pages that use breadcrumbs

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

CVSS 3.0 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-14643

smart_proxy_dynflow: Authentication bypass in Foreman remote execution feature

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2018-14623

katello: SQL inject in errata-related REST API

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2018-12547

JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()

In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Eclipse Redhat
Products
Openj9 Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2018-11751

puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Server Satellite Satellite Capsule
CVE-2018-10931

cobbler: CobblerXMLRPCInterface exports all its methods over XMLRPC

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

CVSS 3.0 · 9.8 Critical EPSS 68.1% KEV · Not listed
Vendors
Cobbler Project Redhat
Products
Cobbler Network Satellite Satellite
CVE-2018-10917

pulp: Improper path parsing leads to overwriting of iso repositories

pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

CVSS 3.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Rhui Satellite and 1 more
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-1000632

dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Dom4j Project Netapp and 2 more
Products
Debian Linux Dom4j Oncommand Workflow Automation and 14 more
CVE-2018-1000119

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

CVSS 3.0 · 5.9 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Sinatrarb
Products
Enterprise Linux Satellite Satellite Capsule and 1 more
CVE-2017-7538

5: organization name allows XSS

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

CVSS 3.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2017-7536

hibernate-validator: Privilege escalation when running under the security manager

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hibernate Validator Jboss Amq and 6 more
CVE-2017-7514

SAT 5 XSS in the Failed Systems page

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Network Satellite Managed Db Satellite
CVE-2017-7513

5: Failure to verify DB hostname against hostname in certificate in PostgreSQL through SSL configuration

It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite