Red Hat Security Advisory

RHSA-2016:0590

spacewalk-java security update

Released 2016-04-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 5.7 (RHEL v.6) spacewalk-java-2.3.8-134.el6sat, spacewalk-java-config-2.3.8-134.el6sat, spacewalk-java-lib-2.3.8-134.el6sat +3

Fixes 4 records

TI-2016-02578 CVE-2016-3079 · GHSA-rh9g-8vr9-r79f

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.d…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01578 Published 2016-04-14 Fixed CWE-79

TI-2016-01928 CVE-2016-2104 · GHSA-ch75-g728-9c8j

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) sear…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01175 Published 2017-04-13 Fixed CWE-79

TI-2016-01927 CVE-2016-2103 · GHSA-wg72-v872-gmrc

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0112 Published 2016-04-14 Fixed CWE-79

TI-2015-00249 CVE-2015-0284 · GHSA-q4pf-r4w7-4wpv

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat…

LOW 27

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01244 Published 2016-04-14 Partial fix CWE-79