Red Hat Red Hat Network Satellite Server v 5.4 vulnerabilities

CVE-2012-0059 Medium · 4.9 CWE-209 Feb 5, 2014

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

CVE-2011-3344 Medium · 5.4 CWE-79 Feb 5, 2014

Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.

CVE-2011-2927 Medium · 5.4 CWE-79 Feb 5, 2014

Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms

A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors related to Search forms, enabling attackers to potentially steal sensitive information or perform actions on behalf of the victim.

CVE-2011-2920 Medium · 5.5 CWE-79 Feb 5, 2014

Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.

CVE-2011-1594 Medium · 6.5 CWE-601 Feb 5, 2014

Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.

CVE-2013-2056 High · 7.5 CWE-306 Jul 31, 2013

Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass

A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure.

CVE-2011-4346 Medium · 4.6 CWE-79 Dec 10, 2011

Satellite: xss in custom system information key handling

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.

CVE-2009-4139 Medium · 6.8 CWE-346 Jul 26, 2011

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.