Search Results (Refine Search)
- CPE Product Version: cpe:/a:redhat:satellite:6.1
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2023-4320 |
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity. Published: December 18, 2023; 9:15:09 AM -0500 |
V3.1: 7.5 HIGH V2.0:(not available) |
CVE-2023-0462 |
An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload. Published: September 20, 2023; 10:15:12 AM -0400 |
V3.1: 9.1 CRITICAL V2.0:(not available) |
CVE-2019-3845 |
A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands. Published: April 11, 2019; 11:29:00 AM -0400 |
V3.1: 8.0 HIGH V2.0: 5.2 MEDIUM |
CVE-2018-14666 |
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions. Published: January 22, 2019; 10:29:00 AM -0500 |
V3.0: 7.2 HIGH V2.0: 6.5 MEDIUM |
CVE-2017-12175 |
Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality. Published: July 26, 2018; 1:29:00 PM -0400 |
V3.0: 5.4 MEDIUM V2.0: 3.5 LOW |
CVE-2016-3072 |
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter. Published: June 07, 2016; 2:59:01 PM -0400 |
V3.0: 8.8 HIGH V2.0: 6.5 MEDIUM |
CVE-2015-5233 |
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs. Published: April 11, 2016; 5:59:01 PM -0400 |
V3.0: 4.2 MEDIUM V2.0: 6.0 MEDIUM |