Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2014-0130

rubygem-actionpack: directory traversal issue

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CVSS 3.1 · 7.5 High EPSS 53.7% KEV · Listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Cloudforms Managementengine Enterprise Linux Server Rhel Software Collections and 3 more
CVE-2015-7501

apache-commons-collections: InvokerTransformer code execution during deserialisation

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS 3.0 · 9.8 Critical EPSS 85.6% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss A-mq and 19 more
CVE-2014-0029

katello-headpin: Multiple XSS

Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Subscription Asset Manager
CVE-2013-1823

Katello: Notifications page Username XSS

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Rhel Sam
Products
Subscription Asset Manager 1.2
CVE-2013-6439

candlepin: insecure authentication enabled by default

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.

CVSS 2.0 · 9.3 Critical EPSS 1.6% KEV · Not listed
Vendors
Redhat Rhel Sam
Products
Subscription Asset Manager 1.3
CVE-2014-0183

XSS: HTML in systems name (when registering) gets interpreted on system information page

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Subscription Asset Manager