CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2056 – Satellite: Inter-Satellite Sync (ISS) does not require authentication/authorization
https://notcve.org/view.php?id=CVE-2013-2056
21 May 2013 — The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call. La operación Inter-Satellite Sync (ISS) en Red Hat Network (RHN) Satellite 5.3, 5.4, y 5.5 no valida adecuadamente la "autenticidad" del cliente, lo que permite a atacantes remotos obtener el contenido de un canal evitando la llamada inicial para la autenticación. Red H... • http://rhn.redhat.com/errata/RHSA-2013-0848.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2012-1145 – satellite: remote package upload without authorization
https://notcve.org/view.php?id=CVE-2012-1145
16 Jun 2012 — spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads. spacewalk-backend de Red Hat Network Satellite 5.4 de Red Hat Enterprise Linux 6 no autoriza ni autentica apropiadamente las subidas a la organización NULL si mod_wsgi es utilizado... • http://rhn.redhat.com/errata/RHSA-2012-0436.html • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4346 – satellite: XSS flaw in custom system information key handling
https://notcve.org/view.php?id=CVE-2011-4346
10 Dec 2011 — Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en la interfaz web de Red Hat Network (RHN) Satellite v5.4.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través del campo Description de la etiqueta de propiedad... • http://secunia.com/advisories/47162 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1171 – rhn_satellite: Improper channel comps information management
https://notcve.org/view.php?id=CVE-2010-1171
18 Apr 2011 — Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels. Vulnerabilidad de redirección abierta en el obsoleto API de XML-RPC en Red Hat Network (RHN) Satellite v5.3 y v5.4, que permite a usuarios remotos autenticados acceder a archivos arbitrarios y causar una denegación de ... • http://secunia.com/advisories/44150 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-2369 – Satellite: information disclosure via manzier.pxt RPC script
https://notcve.org/view.php?id=CVE-2008-2369
14 Aug 2008 — manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements. manzier.pxt en Red Hat Network Satellite Server en versiones anteriores a la 5.1.1 tiene una clave de autenticación fijada en codigo ("Hard-coded"), que permite a atacantes remotos conectarse al servidor y obtener información sensible sobre cuentas de usuario y derechos. • http://rhn.redhat.com/errata/RHSA-2008-0630.html • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 18%CPEs: 16EXPL: 0CVE-2007-1349 – mod_perl PerlRun denial of service
https://notcve.org/view.php?id=CVE-2007-1349
30 Mar 2007 — PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. PerlRun.pm en Apache mod_perl versiones anteriores a 1.30, y RegistryCooker.pm en mod_perl versiones 2.x, no escapa correctamente el PATH_INFO antes de usarlo en una expresión regular, lo que permite a atacantes remotos causar una denegación de servicio (con... • ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc • CWE-20: Improper Input Validation •