CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0026
https://notcve.org/view.php?id=CVE-2014-0026
katello-headpin is vulnerable to CSRF in REST API katello-headpin es vulnerable a un ataque de tipo CSRF en la API REST. • https://access.redhat.com/security/cve/cve-2014-0026 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0026 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0029
https://notcve.org/view.php?id=CVE-2014-0029
Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Múltiples vulnerabilidades de Cross-Site Scripting (XSS) en la aplicación web SAM en Red Hat katello-headpin permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante parámetros sin especificar. • https://bugzilla.redhat.com/show_bug.cgi?id=1059433 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 39EXPL: 0CVE-2014-0130 – Ruby on Rails Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2014-0130
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request. Vulnerabilidad de salto de directorio en actionpack/lib/abstract_controller/base.rb en la implementación implicit-render en Ruby on Rails anterior a 3.2.18, 4.0.x anterior a 4.0.5 y 4.1.x anterior a 4.1.1, cuando ciertas configuraciones de coincidencia de patrones en rutas basadas en caracteres comodín (globbing) están habilitadas, permite a atacantes remotos leer archivos arbitrarios a través de una solicitud manipulada. A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted request. Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request. • http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf http://rhn.redhat.com/errata/RHSA-2014-1863.html http://www.securityfocus.com/bid/67244 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ https://access.redhat.com/security/cve/CVE-2014-0130 https://bugzilla.redhat.com/show_bug.cgi?id=1095105 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2013-6439 – candlepin: insecure authentication enabled by default
https://notcve.org/view.php?id=CVE-2013-6439
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors. Candlepin en Red Hat Subscription Asset Manager v1.0 hasta v1.3 utiliza un esquema de autenticación débil cuando el archivo de configuración no especifica un esquema, lo cual tiene un impacto no especificado y vectores de ataque. • http://rhn.redhat.com/errata/RHSA-2013-1863.html https://bugzilla.redhat.com/show_bug.cgi?id=1042677 https://exchange.xforce.ibmcloud.com/vulnerabilities/90134 https://access.redhat.com/security/cve/CVE-2013-6439 • CWE-287: Improper Authentication CWE-290: Authentication Bypass by Spoofing •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2013-1823 – Katello: Notifications page Username XSS
https://notcve.org/view.php?id=CVE-2013-1823
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en los Notifications de Red Hat Subscription Asset Manager antes de v1.2.1 que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo de nombre de usuario (Username) • http://rhn.redhat.com/errata/RHSA-2013-0686.html http://secunia.com/advisories/52774 http://www.osvdb.org/91718 https://bugzilla.redhat.com/show_bug.cgi?id=918784 https://access.redhat.com/security/cve/CVE-2013-1823 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •