Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2017-7470

spacewalk-backend: spacewalk-channel can be used by non-admin or disabled users for performing administrative tasks

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite Spacewalk
CVE-2017-2672

foreman: Image password leak

A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2017-2667

rubygem-hammer_cli: no verification of API server's SSL certificate

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Hammer Cli
CVE-2017-2662

foreman: Managing repositories with their id via hammer does not respect the role filters

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2017-15699

Interconnect: Denial of Service vulnerability in Red Hat JBoss AMQ Interconnect

A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Dispatch Satellite Satellite Capsule
CVE-2017-15136

katello: system registration hostname hijacking results in inability to access updates

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates.

CVSS 3.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite
CVE-2017-12175

6: XSS in discovery rule filter autocomplete functionality

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

CVSS 3.0 · 3.5 Low EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2017-10690

puppet: Environment leakage in puppet-agent

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Puppet Enterprise Satellite and 1 more
CVE-2017-10689

puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Puppet Redhat
Products
Ubuntu Linux Puppet Puppet Enterprise and 1 more
CVE-2016-9595

katello-debug: Possible symlink attacks due to use of predictable file names

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Katello
CVE-2016-9593

foreman-debug: missing obfuscation of sensitive information

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-8639

foreman: Stored XSS via organization/location with HTML in name

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-8634

foreman: Stored XSS in org/loc wizard

A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-8613

foreman: Stored XSS vulnerability in remote execution plugin

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

CVSS 3.0 · 6.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-7078

foreman: Information leak through organizations and locations feature

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-7077

foreman: Foreman information leak through unauthorized multiple_checkboxes helper

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2015-1931

JDK: plain text data stored in memory dumps

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Enterprise Linux Desktop Enterprise Linux Eus and 7 more
CVE-2015-0203

qpid-cpp: 3 qpidd DoS issues in AMQP 0-10 protocol handling

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3) a session-gap control before a corresponding session-attach.

CVSS 3.0 · 6.5 Medium EPSS 8.5% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg Satellite and 1 more
CVE-2014-8183

foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman