Vulnerabilities

TI-2013-03599 CVE-2013-4120 · GHSA-j9xv-q659-fr6q

Katello has a Denial of Service vulnerability in API OAuth authentication

LOW 35

Katello has a Denial of Service vulnerability in API OAuth authentication

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01304 Published 2019-12-10 No fix listed CWE-400

TI-2013-00214 CVE-2013-0283 · GHSA-jq8g-78xv-qr5j

Katello: Username in Notification page has cross site scripting

LOW 25

Katello: Username in Notification page has cross site scripting

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00552 Published 2019-12-05 Will not fix CWE-79

TI-2013-01870 CVE-2013-2101 · GHSA-h2xj-h22h-459c

Katello has multiple XSS issues in various entities

LOW 25

Katello has multiple XSS issues in various entities

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00552 Published 2019-12-03 Partial fix CWE-79

TI-2019-11030 CVE-2019-14825 · GHSA-m4wh-848j-9w2r

Cleartext storage of sensitive information in Red Hat katello

LOW 15

A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00652 Published 2019-11-25 Fixed in 3.12.2 CWE-312

TI-2018-12097 CVE-2018-16887 · GHSA-mhhc-r88h-2qrm

Cross-site scripting in katello

LOW 26

A cross-site scripting (XSS) flaw was found in the katello component of Satellite.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00999 Published 2019-01-13 Fixed in 3.9.0 CWE-79

TI-2018-10488 CVE-2018-14623 · GHSA-jx5v-788g-qw58

Information disclosure through error messages in Foreman Project katello

LOW 23

A SQL injection flaw was found in katello's errata-related API.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01428 Published 2018-12-13 Partial fix CWE-209

TI-2017-01908 CVE-2017-2662 · GHSA-cpv6-pfq6-j2v7

Missing authorization in foreman katello plugin

LOW 22

A flaw was found in Foreman's katello plugin version 3.4.5.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00938 Published 2018-08-22 Partial fix · 3.17.0.rc1 CWE-862

TI-2016-07816 CVE-2016-9595 · GHSA-4fx8-jx6v-vjhj

Link following in Foreman Project katello-debug

LOW 32

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files.

CVSS 3.0HIGH 7.3 Local Low privileges User interaction EPSS 0.00403 Published 2018-07-27 Fixed CWE-377

TI-2013-01912 CVE-2013-2143 · GHSA-rhwm-66gm-6j9v

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not…

MEDIUM 59

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.48221 Published 2014-04-17 Will not fix CWE-20

TI-2012-03031 CVE-2012-3503 · GHSA-5xv2-q475-rwrh

The installation script in Katello 1.0 and earlier does not properly generate the…

MEDIUM 48

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03002 Published 2012-08-25 Fixed in 1.0.6, 1.1.7 CWE-798

Vulnerabilities

Filters