Theforeman
Theforeman Katello: vulnerabilidades y CVE
Theforeman Katello tiene 10 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE10
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2013-4120 | Alta (7.5) | 1.3% | — | 10 dic 2019 | Katello has a Denial of Service vulnerability in API OAuth authentication |
| CVE-2013-0283 | Media (5.4) | 0.55% | — | 5 dic 2019 | Katello: Username in Notification page has cross site scripting |
| CVE-2013-2101 | Media (5.4) | 0.55% | — | 3 dic 2019 | Katello has multiple XSS issues in various entities |
| CVE-2019-14825 | Baja (2.7) | 0.65% | — | 25 nov 2019 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This… |
| CVE-2018-16887 | Media (5.4) | 1.00% | — | 13 ene 2019 | A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the… |
| CVE-2018-14623 | Media (4.3) | 1.4% | — | 14 dic 2018 | A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue… |
| CVE-2017-2662 | Media (4.3) | 0.94% | — | 22 ago 2018 | A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the… |
| CVE-2016-9595 | Media (5.5) | 0.40% | — | 27 jul 2018 | A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the… |
| CVE-2013-2143 | Media (6.5) | 48% | — | 17 abr 2014 | The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account… |
| CVE-2012-3503 | Crítica (9.8) | 3.0% | — | 25 ago 2012 | The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers… |