CveMateVulnerability intelligence

Redhat Satellite vulnerabilities, page 4

241 vulnerabilities

Known vulnerabilities in Redhat Satellite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2013-6461debiandebian_linux+86y ago05-11-2019 14:07

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits CVE-2013-6460debiandebian_linux+86y ago05-11-2019 14:02

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents CVE-2021-42550chainguardeco-java-gradle-1.11+1084y ago16-12-2021 00:00

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.CVE-2021-20256redhatsatellite5y ago23-02-2021 22:31

A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-44420canonicalubuntu_linux+94y ago07-12-2021 22:55

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.CVE-2021-3414redhatsatellite4y ago26-08-2022 15:25

A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality.CVE-2021-3584redhatsatellite+14y ago23-12-2021 19:48

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.CVE-2021-3589RubyGemsforeman_ansible+24y ago23-03-2022 19:46

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-3590redhatsatellite+14y ago22-08-2022 14:48

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-3413redhatsatellite+15y ago08-04-2021 22:06

A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2015-2808canonicalubuntu_linux+6211y ago01-04-2015 00:00

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.CVE-2015-2590canonicalubuntu_linux+22KEV11y ago16-07-2015 10:00

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.CVE-2015-1931ibmjava_sdk+76y ago23-01-2020 18:42

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.CVE-2015-0284redhatsatellite+110y ago14-04-2016 14:00

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.CVE-2015-4902opensuseleap+20KEV11y ago21-10-2015 23:00

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.CVE-2015-5006ibmjava_2_sdk+810y ago07-12-2015 20:00

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15, and 6 before SR16 FP15 allow physically proximate attackers to obtain sensitive information by reading the Kerberos Credential Cache.CVE-2015-5233redhatsatellite+4110y ago11-04-2016 21:00

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.CVE-2015-5041ibmjava_sdk+510y ago06-06-2016 17:00

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.CVE-2015-8126applemac_os_x+5010y ago13-11-2015 02:00

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.CVE-2007-1349apachemod_perl+1019y ago30-03-2007 00:00

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.