CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2011-2927 – Satellite/Spacewalk: XSS flaw in channels search
https://notcve.org/view.php?id=CVE-2011-2927
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allow remote attackers to inject arbitrary web script or HTML via vectors related to Search forms. Múltiples vulnerabilidades de XSS en Spacewalk 1.6, utilizado en Red Hat Network (RHN) Satellite, permiten a atacantes remotos inyectar script Web o HTML arbitrario a través de vectores relacionados con formularios de búsqueda. • http://www.redhat.com/support/errata/RHSA-2011-1299.html https://bugzilla.redhat.com/show_bug.cgi?id=730955 https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html https://access.redhat.com/security/cve/CVE-2011-2927 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1594 – Spacewalk: login page open redirect via url_bounce
https://notcve.org/view.php?id=CVE-2011-1594
Open redirect vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url_bounce parameter. Vulnerabilidad de redirección abierta en Spacewalk 1.6, utilizado en Red Hat Network (RHN) Satellite, permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y efectuar ataques de phishing a través de una URL en el parámetro url_bounce. • http://www.redhat.com/support/errata/RHSA-2011-1299.html https://bugzilla.redhat.com/show_bug.cgi?id=672167 https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html https://access.redhat.com/security/cve/CVE-2011-1594 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2009-4139 – Spacewalk: CSRF in all web portal forms
https://notcve.org/view.php?id=CVE-2009-4139
Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account, (2) add user accounts, or (3) modify user accounts to have administrator privileges. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en los paquetes Spacewalk Java (spacewalk-java) 1.2.39 de Spacewalk, tal como se utiliza en el servidor de Red Hat Network Satellite 5.3.0 hasta la versión 5.4.1 y otros productos, permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que (1) deshabilitan la cuenta del usuario actual, (2) añaden cuentas de usuarios, o (3) modifican cuentas de usuarios para tener privilegios administrativos. • http://securitytracker.com/id?1025674 http://www.redhat.com/support/errata/RHSA-2011-0879.html https://bugzilla.redhat.com/show_bug.cgi?id=529483 https://exchange.xforce.ibmcloud.com/vulnerabilities/68074 https://access.redhat.com/security/cve/CVE-2009-4139 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0788 – rhn_satellite: Incorrect mod_rewrite rules (information disclosure, abuse as distributed DoS tool)
https://notcve.org/view.php?id=CVE-2009-0788
Red Hat Network (RHN) Satellite Server 5.3 and 5.4 does not properly rewrite unspecified URLs, which allows remote attackers to (1) obtain unspecified sensitive host information or (2) use the server as an inadvertent proxy to connect to arbitrary services and IP addresses via unspecified vectors. Red Hat Network (RHN) Satellite Server 5.3 y 5.4 no reescribe correctamente URLs no especificadas, lo que permite a atacantes remotos (1) obtener información sensible no especificado del anfitrión o (2) utilizar el servidor como un proxy inadvertido para conectar con servicios y direcciones IP arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/44150 http://www.redhat.com/support/errata/RHSA-2011-0434.html http://www.securityfocus.com/bid/47316 http://www.securitytracker.com/id?1025316 http://www.vupen.com/english/advisories/2011/0967 https://bugzilla.redhat.com/show_bug.cgi?id=491365 https://exchange.xforce.ibmcloud.com/vulnerabilities/66691 https://access.redhat.com/security/cve/CVE-2009-0788 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-0717 – Spacewalk: Session fixation flaw
https://notcve.org/view.php?id=CVE-2011-0717
Session fixation vulnerability in Red Hat Network (RHN) Satellite Server 5.4 allows remote attackers to hijack web sessions via unspecified vectors related to Spacewalk. Vulnerabilidad de fijación de sesión en Red Hat Network (RHN) Satellite Server v5.4 permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados relacionados con Spacewalk • http://secunia.com/advisories/43487 http://www.redhat.com/support/errata/RHSA-2011-0300.html http://www.securityfocus.com/bid/46528 http://www.securitytracker.com/id?1025116 http://www.vupen.com/english/advisories/2011/0491 https://bugzilla.redhat.com/show_bug.cgi?id=672159 https://exchange.xforce.ibmcloud.com/vulnerabilities/65658 https://access.redhat.com/security/cve/CVE-2011-0717 • CWE-384: Session Fixation •