CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7538 – 5: organization name allows XSS
https://notcve.org/view.php?id=CVE-2017-7538
A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users. Se ha detectado una vulnerabilidad Cross-Site Scripting (XSS) en la manera en la que se muestra un nombre de organización en Satellite 5 en versiones anteriores a la 5.8. Un usuario capaz de cambiar el nombre de una organización podría explotar esta vulnerabilidad para realizar ataques Cross-Site Scripting (XSS) contra otros usuarios de Satellite. A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5. • http://www.securitytracker.com/id/1039267 https://access.redhat.com/errata/RHSA-2017:2645 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7538 https://access.redhat.com/security/cve/CVE-2017-7538 https://bugzilla.redhat.com/show_bug.cgi?id=1471262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8163
https://notcve.org/view.php?id=CVE-2014-8163
Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5. Existe una vulnerabilidad de salto de directorio en la interfaz XMLRPC en Red Hat Satellite 5. • https://access.redhat.com/security/cve/cve-2014-8163 https://bugzilla.redhat.com/show_bug.cgi?id=1187340 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8168
https://notcve.org/view.php?id=CVE-2014-8168
Red Hat Satellite 6 allows local users to access mongod and delete pulp_database. Red Hat Satellite 6 permite que los usuarios locales accedan a mongod y borren pulp_database. • https://bugzilla.redhat.com/show_bug.cgi?id=1192249 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0141
https://notcve.org/view.php?id=CVE-2014-0141
Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Red Hat Satellite 6.0.3. • https://bugzilla.redhat.com/show_bug.cgi?id=1187466 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 46EXPL: 0CVE-2017-10078 – OpenJDK: Nashorn incompletely blocking access to Java APIs (Scripting, 8171539)
https://notcve.org/view.php?id=CVE-2017-10078
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. • http://www.debian.org/security/2017/dsa-3919 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.securityfocus.com/bid/99752 http://www.securitytracker.com/id/1038931 https://access.redhat.com/errata/RHSA-2017:1789 https://access.redhat.com/errata/RHSA-2017:1790 https://access.redhat.com/errata/RHSA-2017:2469 https://access.redhat.com/errata/RHSA-2017:3453 https://cert.vde.com/en-us/advisories/vde-2017-002 https://security.gentoo.org/g •