satellite capsule vulnerabilities and exploits

(subscribe to this query)

A flaw was found in katello-debug prior to 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Theforeman Katello Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

It was found that foreman prior to 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

Theforeman Foreman Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

Theforeman Hammer Cli Redhat Satellite 6.3 Redhat Satellite Capsule 6.3

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitiv...

Redhat Satellite Capsule 6.7 Redhat Satellite 6.7 Theforeman Foreman Ansible

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an malicious user to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore gener...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Redhat Satellite 6.4 Redhat Satellite Capsule 6.4

In Hibernate Validator 5.2.x prior to 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occ...

Redhat Hibernate Validator Redhat Satellite 6.4 Redhat Satellite Capsule 6.4 Redhat Jboss Enterprise Application Platform 6.0.0 Redhat Jboss Enterprise Application Platform 6.4.0 Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1 Redhat Virtualization 4.0 Redhat Virtualization Host 4.0

2 Github repositories

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows malicious users to bypass input sanitation (escaping, stripping) controls that develope...

Redhat Hibernate Validator 7.0.0 Redhat Hibernate Validator Ibm Websphere Application Server Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Jboss Enterprise Application Platform 7.3.0 Redhat Satellite Capsule 6.8 Redhat Satellite 6.8 Quarkus Quarkus Oracle Weblogic Server 14.1.1.0.0

3 Github repositories

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or C...

Redhat Satellite

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specify...

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-5233. Reason: This candidate is a reservation duplicate of CVE-2015-5233. Notes: All CVE users should reference CVE-2015-5233 instead of this candidate. All references and descriptions in this candidate have ...

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook