|
2019-11-05
|
CVE-2013-6460
|
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
|
Debian_linux, Nokogiri, Cloudforms_management_engine, Enterprise_mrg, Openstack, Satellite, Subscription_asset_manager
|
6.5
|
|
|
|
2020-05-06
|
CVE-2020-10693
|
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
|
Websphere_application_server, Quarkus, Hibernate_validator, Jboss_enterprise_application_platform, Satellite, Satellite_capsule
|
5.3
|
|
|
|
2017-03-13
|
CVE-2017-5929
|
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
|
Logback, Satellite, Satellite_capsule
|
9.8
|
|
|
|
2021-06-02
|
CVE-2020-14380
|
An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.
|
Satellite
|
7.5
|
|
|
|
2018-08-20
|
CVE-2018-1000632
|
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
|
Debian_linux, Dom4j, Oncommand_workflow_automation, Snap_creator_framework, Snapcenter, Snapmanager, Flexcube_investor_servicing, Primavera_p6_enterprise_project_portfolio_management, Rapid_planning, Retail_integration_bus, Utilities_framework, Jboss_enterprise_application_platform, Satellite, Satellite_capsule
|
7.5
|
|
|
|
2021-06-02
|
CVE-2020-14371
|
A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite.
|
Satellite
|
6.5
|
|
|
|
2018-04-26
|
CVE-2018-10237
|
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
|
Guava, Banking_payments, Communications_ip_service_activator, Customer_management_and_segmentation_foundation, Database_server, Flexcube_investor_servicing, Flexcube_private_banking, Retail_integration_bus, Retail_xstore_point_of_service, Weblogic_server, Jboss_enterprise_application_platform, Openshift_container_platform, Openstack, Satellite, Satellite_capsule, Virtualization, Virtualization_host
|
5.9
|
|
|
|
2021-05-27
|
CVE-2020-10716
|
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.
|
Satellite, Satellite_capsule, Foreman_ansible
|
6.5
|
|
|
|
2021-06-02
|
CVE-2020-14335
|
A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from this vulnerability is to system availability.
|
Satellite
|
5.5
|
|
|
|
2018-04-16
|
CVE-2018-5382
|
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the...
|
Legion\-Of\-The\-Bouncy\-Castle\-Java\-Crytography\-Api, Satellite, Satellite_capsule
|
9.8
|
|
|