CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0059 – Spacewalk: RHN user password disclosure upon failed system registration
https://notcve.org/view.php?id=CVE-2012-0059
Spacewalk-backend in Red Hat Network (RHN) Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading (1) the server log and (2) an email. El backend de Spacewalk en Red Hat Network (RHN) Satellite y Proxy 5.4 incluye contraseñas de usuario en texto claro en un mensaje de error cuando la llamada XML-RPC del registro del sistema falla, permite a administradores remotos obtener la contraseña mediante la lectura de (1) las trazas del servidor y (2) un correo. • http://rhn.redhat.com/errata/RHSA-2012-0101.html http://rhn.redhat.com/errata/RHSA-2012-0102.html https://access.redhat.com/security/cve/CVE-2012-0059 https://bugzilla.redhat.com/show_bug.cgi?id=782819 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4346 – satellite: XSS flaw in custom system information key handling
https://notcve.org/view.php?id=CVE-2011-4346
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en la interfaz web de Red Hat Network (RHN) Satellite v5.4.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través del campo Description de la etiqueta de propiedad en una página de información personalizada. • http://secunia.com/advisories/47162 http://www.redhat.com/support/errata/RHSA-2011-1794.html http://www.securityfocus.com/bid/50963 http://www.securitytracker.com/id?1026391 https://bugzilla.redhat.com/show_bug.cgi?id=742050 https://access.redhat.com/security/cve/CVE-2011-4346 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1171 – rhn_satellite: Improper channel comps information management
https://notcve.org/view.php?id=CVE-2010-1171
Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels. Vulnerabilidad de redirección abierta en el obsoleto API de XML-RPC en Red Hat Network (RHN) Satellite v5.3 y v5.4, que permite a usuarios remotos autenticados acceder a archivos arbitrarios y causar una denegación de servicio (operaciones fallida de YUM) a través de vectores relacionados con la de configuración y el paquete (comps.xml )de archivos de los canales. • http://secunia.com/advisories/44150 http://www.redhat.com/support/errata/RHSA-2011-0434.html http://www.securityfocus.com/bid/47316 http://www.securitytracker.com/id?1025316 http://www.vupen.com/english/advisories/2011/0967 https://bugzilla.redhat.com/show_bug.cgi?id=584118 https://exchange.xforce.ibmcloud.com/vulnerabilities/66690 https://access.redhat.com/security/cve/CVE-2010-1171 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-2369 – Satellite: information disclosure via manzier.pxt RPC script
https://notcve.org/view.php?id=CVE-2008-2369
manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements. manzier.pxt en Red Hat Network Satellite Server en versiones anteriores a la 5.1.1 tiene una clave de autenticación fijada en codigo ("Hard-coded"), que permite a atacantes remotos conectarse al servidor y obtener información sensible sobre cuentas de usuario y derechos. • http://rhn.redhat.com/errata/RHSA-2008-0630.html http://secunia.com/advisories/31493 http://securitytracker.com/id?1020694 http://www.securityfocus.com/bid/30679 https://exchange.xforce.ibmcloud.com/vulnerabilities/44452 https://access.redhat.com/security/cve/CVE-2008-2369 https://bugzilla.redhat.com/show_bug.cgi?id=452461 • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 0CVE-2007-1349 – mod_perl PerlRun denial of service
https://notcve.org/view.php?id=CVE-2007-1349
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. PerlRun.pm en Apache mod_perl versiones anteriores a 1.30, y RegistryCooker.pm en mod_perl versiones 2.x, no escapa correctamente el PATH_INFO antes de usarlo en una expresión regular, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) por medio de un URI especialmente diseñado. • ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc http://rhn.redhat.com/errata/RHSA-2007-0395.html http://rhn.redhat.com/errata/RHSA-2008-0630.html http://secunia.com/advisories/24678 http://secunia.com/advisories/24839 http://secunia.com/advisories/25072 http://secunia.com/advisories/25110 http://secunia.com/advisories/25432 http://secunia.com/advisories/25655 http://secunia.com/advisories/25730 http://secunia.com/advisories/25894 http://secun • CWE-20: Improper Input Validation •