CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2013-1871 – Satellite/Spacewalk: XSS in EditAddress page
https://notcve.org/view.php?id=CVE-2013-1871
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter. Vulnerabilidad de XSS en account/EditAddress.do en Spacewalk y Red Hat Network (RHN) Satellite 5.6 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro type. • http://osvdb.org/103211 http://rhn.redhat.com/errata/RHSA-2014-0148.html http://secunia.com/advisories/56952 https://bugzilla.redhat.com/show_bug.cgi?id=923467 https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html https://access.redhat.com/security/cve/CVE-2013-1871 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2013-4480 – Satellite: Interface to create the initial administrator user remains open after installation
https://notcve.org/view.php?id=CVE-2013-4480
Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts. Red Hat Satellite 5.6 y anteriores versiones no deshabilita la interfaz web que es usada para crear el primer usuario para un satellite, lo que permite a atacantes remotos crear cuentas de administrador. • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.html http://rhn.redhat.com/errata/RHSA-2013-1513.html http://rhn.redhat.com/errata/RHSA-2013-1514.html https://access.redhat.com/site/articles/539283 https://bugzilla.redhat.com/show_bug.cgi?id=1024614 https://access.redhat.com/security/cve/CVE-2013-4480 • CWE-668: Exposure of Resource to Wrong Sphere CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2056 – Satellite: Inter-Satellite Sync (ISS) does not require authentication/authorization
https://notcve.org/view.php?id=CVE-2013-2056
The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call. La operación Inter-Satellite Sync (ISS) en Red Hat Network (RHN) Satellite 5.3, 5.4, y 5.5 no valida adecuadamente la "autenticidad" del cliente, lo que permite a atacantes remotos obtener el contenido de un canal evitando la llamada inicial para la autenticación. • http://rhn.redhat.com/errata/RHSA-2013-0848.html http://secunia.com/advisories/53487 http://www.osvdb.org/93566 https://access.redhat.com/security/cve/CVE-2013-2056 https://bugzilla.redhat.com/show_bug.cgi?id=959524 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 0CVE-2012-1145 – satellite: remote package upload without authorization
https://notcve.org/view.php?id=CVE-2012-1145
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads. spacewalk-backend de Red Hat Network Satellite 5.4 de Red Hat Enterprise Linux 6 no autoriza ni autentica apropiadamente las subidas a la organización NULL si mod_wsgi es utilizado, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de la partición de disco /var y actualizaciones fallidas) a través de un gran número de subida de paquetes. • http://rhn.redhat.com/errata/RHSA-2012-0436.html http://secunia.com/advisories/48664 http://www.osvdb.org/81481 http://www.securityfocus.com/bid/52832 http://www.securitytracker.com/id?1026873 https://exchange.xforce.ibmcloud.com/vulnerabilities/74498 https://access.redhat.com/security/cve/CVE-2012-1145 https://bugzilla.redhat.com/show_bug.cgi?id=800688 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0059 – Spacewalk: RHN user password disclosure upon failed system registration
https://notcve.org/view.php?id=CVE-2012-0059
Spacewalk-backend in Red Hat Network (RHN) Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading (1) the server log and (2) an email. El backend de Spacewalk en Red Hat Network (RHN) Satellite y Proxy 5.4 incluye contraseñas de usuario en texto claro en un mensaje de error cuando la llamada XML-RPC del registro del sistema falla, permite a administradores remotos obtener la contraseña mediante la lectura de (1) las trazas del servidor y (2) un correo. • http://rhn.redhat.com/errata/RHSA-2012-0101.html http://rhn.redhat.com/errata/RHSA-2012-0102.html https://access.redhat.com/security/cve/CVE-2012-0059 https://bugzilla.redhat.com/show_bug.cgi?id=782819 • CWE-310: Cryptographic Issues •