|
2019-04-09
|
CVE-2019-3893 |
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable. |
Satellite,
Foreman
|
4.9
|
|
|
2019-04-15
|
CVE-2019-3891 |
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates. |
Satellite
|
7.8
|
|
|
2019-04-11
|
CVE-2019-3845 |
A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands. |
Satellite
|
8.0
|
|
|
2019-10-17
|
CVE-2019-17631 |
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. |
Openj9,
Enterprise_linux,
Enterprise_linux_desktop,
Enterprise_linux_eus,
Enterprise_linux_server,
Enterprise_linux_workstation,
Satellite
|
9.1
|
|
|
2019-01-16
|
CVE-2019-2449 |
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java... |
Oncommand_unified_manager,
Oncommand_workflow_automation,
Snapmanager,
Jdk,
Jre,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_workstation,
Satellite
|
3.1
|
|
|
2019-01-16
|
CVE-2019-2422 |
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of... |
Ubuntu_linux,
Debian_linux,
Oncommand_unified_manager,
Oncommand_workflow_automation,
Snapmanager,
Leap,
Jdk,
Jre,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_server_aus,
Enterprise_linux_server_eus,
Enterprise_linux_server_tus,
Enterprise_linux_workstation,
Satellite
|
3.1
|
|
|
2018-04-19
|
CVE-2018-2800 |
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or... |
Ubuntu_linux,
Debian_linux,
Xp7_command_view,
Jdk,
Jre,
Jrockit,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_server_aus,
Enterprise_linux_server_eus,
Enterprise_linux_server_tus,
Enterprise_linux_workstation,
Satellite,
Struxureware_data_center_expert
|
4.2
|
|
|
2018-04-19
|
CVE-2018-2799 |
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service... |
Xerces\-J,
Ubuntu_linux,
Debian_linux,
Xp7_command_view,
Jdk,
Jre,
Jrockit,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_server_aus,
Enterprise_linux_server_eus,
Enterprise_linux_server_tus,
Enterprise_linux_workstation,
Satellite,
Struxureware_data_center_expert
|
5.3
|
|
|
2018-04-19
|
CVE-2018-2798 |
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of... |
Ubuntu_linux,
Debian_linux,
Xp7_command_view,
Jdk,
Jre,
Jrockit,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_server_aus,
Enterprise_linux_server_eus,
Enterprise_linux_server_tus,
Enterprise_linux_workstation,
Satellite,
Struxureware_data_center_expert
|
5.3
|
|
|
2018-04-19
|
CVE-2018-2797 |
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of... |
Ubuntu_linux,
Debian_linux,
Xp7_command_view,
Jdk,
Jre,
Jrockit,
Enterprise_linux_desktop,
Enterprise_linux_server,
Enterprise_linux_server_aus,
Enterprise_linux_server_eus,
Enterprise_linux_server_tus,
Enterprise_linux_workstation,
Satellite,
Struxureware_data_center_expert
|
5.3
|
|