Priority MEDIUM 49
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04268 · Published 2020-02-17 · Will not fix CWE-611
Priority LOW 21
It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums.
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00565 · Published 2019-07-02 · Fixed CWE-347
Priority MEDIUM 48
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03121 · Published 2019-07-02 · Fixed CWE-22
Priority MEDIUM 46
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02118 · Published 2018-07-27 · Fixed CWE-863
Priority LOW 35
Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01043 · Published 2018-03-14 · Will not fix CWE-611
Priority LOW 20
Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to inject arbitrary web script or HTML via the System Groups field.
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.01463 · Published 2015-01-15 · Fixed CWE-79
Priority LOW 20
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST A…
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.01463 · Published 2015-01-15 · Fixed CWE-79
Priority LOW 28
A flaw was found in Spacewalk.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.01539 · Published 2014-02-05 · Partial fix · 1.2.2-7.el5sat, 1.2.39-98.el5sat +1 CWE-79
Priority LOW 27
A flaw was found in Spacewalk and Red Hat Network Satellite.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.01468 · Published 2014-02-05 · Partial fix · 1.2.2-7.el5sat, 1.2.39-98.el5sat +1 CWE-79
Priority LOW 29
A flaw was found in Spacewalk and Red Hat Network Satellite.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.0204 · Published 2014-02-05 · Partial fix · 1.2.2-7.el5sat, 1.2.39-98.el5sat +1 CWE-79
Priority LOW 22
Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01188 · Published 2014-02-05 · Fixed CWE-79
Priority LOW 32
A flaw was found in Spacewalk, as used in Red Hat Network Satellite.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01456 · Published 2014-02-05 · Partial fix · 1.2.2-7.el5sat, 1.2.39-98.el5sat +1 CWE-601
THREATIST.IORead the docs