CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4320 – Satellite: arithmetic overflow in satellite
https://notcve.org/view.php?id=CVE-2023-4320
18 Dec 2023 — An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity. Se encontró una falla de desbordamiento aritmético en Satellite al crear un nuevo token de acceso personal. Esta falla permite a un atacante que utiliza este desbordamiento aritmético crear tokens de acceso personal que son válidos indefinidament... • https://access.redhat.com/errata/RHSA-2024:2010 • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5562
https://notcve.org/view.php?id=CVE-2012-5562
02 Dec 2019 — rhn-proxy: may transmit credentials over clear-text when accessing RHN Satellite rhn-proxy: puede transmitir credenciales sobre texto sin cifrar cuando se accesa a RHN Satellite. • https://access.redhat.com/security/cve/cve-2012-5562 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 8%CPEs: 2EXPL: 0CVE-2019-10137 – spacewalk-proxy: Path traversal in proxy authentication cache
https://notcve.org/view.php?id=CVE-2019-10137
02 Jul 2019 — A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process. Se encontró un fallo de salto de ruta (path) en el proxy de spacewalk, en todas las versiones hasta la 2.8, en la manera en que el proxy procesa los tokens del cliente en... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3845 – katello-installer-base: QMF methods exposed to goferd via qdrouterd
https://notcve.org/view.php?id=CVE-2019-3845
09 Apr 2019 — A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands. Se encontró una falta de control de acceso en las colas de mensajes mantenidas por el broker QPID de S... • https://access.redhat.com/errata/RHSA-2019:1223 • CWE-284: Improper Access Control •
CVSS: 5.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-7513
https://notcve.org/view.php?id=CVE-2017-7513
22 Aug 2018 — It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate. Se ha detectado que Satellite 5 configurado con SSL/TLS para el backend PostgreSQL no pudo validar correctamente los campos de nombre de host de certificado de servidor X.509. Un atacante Man-in-the-Middle (MitM) podría usar este fallo ... • https://access.redhat.com/security/cve/cve-2017-7513 • CWE-295: Improper Certificate Validation •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-12175 – 6: XSS in discovery rule filter autocomplete functionality
https://notcve.org/view.php?id=CVE-2017-12175
26 Jul 2018 — Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality. Red Hat Satellite en versiones anteriores a la 6.5 es vulnerable a Cross-Site Scripting (XSS) en la regla discovery cuando se introduce un filtro y se utiliza la funcionalidad de autocompletado. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a ... • http://www.securityfocus.com/bid/101245 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1077
https://notcve.org/view.php?id=CVE-2018-1077
14 Mar 2018 — Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. Spacewalk 2.6 contiene una API que tiene un error XEE (XML External Entity) que permite la divulgación de información potencialmente sensible del servidor. • https://bugzilla.redhat.com/show_bug.cgi?id=1555429 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7538 – 5: organization name allows XSS
https://notcve.org/view.php?id=CVE-2017-7538
06 Sep 2017 — A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users. Se ha detectado una vulnerabilidad Cross-Site Scripting (XSS) en la manera en la que se muestra un nombre de organización en Satellite 5 en versiones anteriores a la 5.8. Un usuario capaz de cambiar el nombre de una organización podría explotar esta vulnerabilidad para realiz... • http://www.securitytracker.com/id/1039267 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8163
https://notcve.org/view.php?id=CVE-2014-8163
28 Aug 2017 — Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5. Existe una vulnerabilidad de salto de directorio en la interfaz XMLRPC en Red Hat Satellite 5. • https://access.redhat.com/security/cve/cve-2014-8163 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7514 – SAT 5 XSS in the Failed Systems page
https://notcve.org/view.php?id=CVE-2017-7514
21 Jun 2017 — A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users. Se ha encontrado un fallo de Cross-Site Scripting (XSS) en la forma en la que la entrada de acción se procesa en Red Hat Satellite en versiones anteriores a la 5.8.0. Un usuario que pueda especificar una acción fallida podría explotar este fallo para realizar ataq... • https://access.redhat.com/errata/RHSA-2017:1558 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •