CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 0CVE-2012-1145 – satellite: remote package upload without authorization
https://notcve.org/view.php?id=CVE-2012-1145
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads. spacewalk-backend de Red Hat Network Satellite 5.4 de Red Hat Enterprise Linux 6 no autoriza ni autentica apropiadamente las subidas a la organización NULL si mod_wsgi es utilizado, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de la partición de disco /var y actualizaciones fallidas) a través de un gran número de subida de paquetes. • http://rhn.redhat.com/errata/RHSA-2012-0436.html http://secunia.com/advisories/48664 http://www.osvdb.org/81481 http://www.securityfocus.com/bid/52832 http://www.securitytracker.com/id?1026873 https://exchange.xforce.ibmcloud.com/vulnerabilities/74498 https://access.redhat.com/security/cve/CVE-2012-1145 https://bugzilla.redhat.com/show_bug.cgi?id=800688 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0059 – Spacewalk: RHN user password disclosure upon failed system registration
https://notcve.org/view.php?id=CVE-2012-0059
Spacewalk-backend in Red Hat Network (RHN) Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading (1) the server log and (2) an email. El backend de Spacewalk en Red Hat Network (RHN) Satellite y Proxy 5.4 incluye contraseñas de usuario en texto claro en un mensaje de error cuando la llamada XML-RPC del registro del sistema falla, permite a administradores remotos obtener la contraseña mediante la lectura de (1) las trazas del servidor y (2) un correo. • http://rhn.redhat.com/errata/RHSA-2012-0101.html http://rhn.redhat.com/errata/RHSA-2012-0102.html https://access.redhat.com/security/cve/CVE-2012-0059 https://bugzilla.redhat.com/show_bug.cgi?id=782819 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4346 – satellite: XSS flaw in custom system information key handling
https://notcve.org/view.php?id=CVE-2011-4346
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en la interfaz web de Red Hat Network (RHN) Satellite v5.4.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través del campo Description de la etiqueta de propiedad en una página de información personalizada. • http://secunia.com/advisories/47162 http://www.redhat.com/support/errata/RHSA-2011-1794.html http://www.securityfocus.com/bid/50963 http://www.securitytracker.com/id?1026391 https://bugzilla.redhat.com/show_bug.cgi?id=742050 https://access.redhat.com/security/cve/CVE-2011-4346 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1171 – rhn_satellite: Improper channel comps information management
https://notcve.org/view.php?id=CVE-2010-1171
Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels. Vulnerabilidad de redirección abierta en el obsoleto API de XML-RPC en Red Hat Network (RHN) Satellite v5.3 y v5.4, que permite a usuarios remotos autenticados acceder a archivos arbitrarios y causar una denegación de servicio (operaciones fallida de YUM) a través de vectores relacionados con la de configuración y el paquete (comps.xml )de archivos de los canales. • http://secunia.com/advisories/44150 http://www.redhat.com/support/errata/RHSA-2011-0434.html http://www.securityfocus.com/bid/47316 http://www.securitytracker.com/id?1025316 http://www.vupen.com/english/advisories/2011/0967 https://bugzilla.redhat.com/show_bug.cgi?id=584118 https://exchange.xforce.ibmcloud.com/vulnerabilities/66690 https://access.redhat.com/security/cve/CVE-2010-1171 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-2369 – Satellite: information disclosure via manzier.pxt RPC script
https://notcve.org/view.php?id=CVE-2008-2369
manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements. manzier.pxt en Red Hat Network Satellite Server en versiones anteriores a la 5.1.1 tiene una clave de autenticación fijada en codigo ("Hard-coded"), que permite a atacantes remotos conectarse al servidor y obtener información sensible sobre cuentas de usuario y derechos. • http://rhn.redhat.com/errata/RHSA-2008-0630.html http://secunia.com/advisories/31493 http://securitytracker.com/id?1020694 http://www.securityfocus.com/bid/30679 https://exchange.xforce.ibmcloud.com/vulnerabilities/44452 https://access.redhat.com/security/cve/CVE-2008-2369 https://bugzilla.redhat.com/show_bug.cgi?id=452461 • CWE-798: Use of Hard-coded Credentials •