Redhat Subscription Asset Manager vulnerabilities
11 vulnerabilities
Known vulnerabilities in Redhat Subscription Asset Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2013-1823redhatsubscription_asset_manager
EPSS score1.90%
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.CVE-2013-6439redhatsubscription_asset_managerEPSS score1.57%
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.CVE-2013-6461debiandebian_linux+8EPSS score2.19%
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsCVE-2013-6460debiandebian_linux+8EPSS score2.08%
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsCVE-2015-7501chainguardeco-java-gradle-1.11+59KEVEPSS score85.56%
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.CVE-2014-0026katello-headpinkatello-headpin+1EPSS score0.43%
katello-headpin is vulnerable to CSRF in REST APICVE-2014-0183katellokatello+1EPSS score0.66%
Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.CVE-2014-0130ubunturails+6KEVEPSS score53.70%
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.CVE-2014-0029redhatsubscription_asset_managerEPSS score0.75%
Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.CVE-2012-6119candlepinprojectcandlepin+1EPSS score0.42%
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.CVE-2012-6685debianlibnokogiri-ruby+11EPSS score2.17%
Nokogiri before 1.5.4 is vulnerable to XXE attacks