redhat satellite 6.3 vulnerabilities and exploits

(subscribe to this query)

3.6

CVSSv2

A flaw was found in katello-debug prior to 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Theforeman Katello Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

3.5

CVSSv2

It was found that foreman prior to 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

Theforeman Foreman Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

6.8

CVSSv2

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

Theforeman Hammer Cli Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

4

CVSSv2

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

Theforeman Foreman Redhat Satellite 6.0

6.5

CVSSv2

It was found that foreman, versions 1.x.x prior to 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

Theforeman Foreman Redhat Satellite 6.0

4.4

CVSSv2

In Hibernate Validator 5.2.x prior to 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occ...

Redhat Hibernate Validator Redhat Satellite 6.4 Redhat Satellite Capsule 6.4 Redhat Jboss Enterprise Application Platform 6.0.0 Redhat Jboss Enterprise Application Platform 6.4.0 Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1 Redhat Virtualization 4.0 Redhat Virtualization Host 4.0

2 Github repositories

5.8

CVSSv2

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenS...

1 Github repository

7.5

CVSSv2

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an malicious user to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of th...

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook