katello vulnerabilities (Red Hat)
196 vulnerabilities.
katelloRed HatThe pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.5.5 MediumkatelloRed Hatclient/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer...7.5 HighkatelloRed Hatpulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate...5.5 MediumkatelloRed HatThe pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or...7.1 HighkatelloRed HatThe Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world...5.5 MediumkatelloRed HatVersions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the...8.2 HighkatelloRed HatDjango open redirect and possible XSS attack via user-supplied numeric redirect URLs6.1 MediumkatelloRed HatQOS.ch Logback vulnerable to Deserialization of Untrusted Data9.8 CriticalkatelloRed HatDenial of service in JBoss resteasy7.5 HighkatelloRed HatCross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in...5.4 MediumkatelloRed HatCross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2,...6.1 MediumkatelloRed HatForeman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview...5.3 MediumkatelloRed HatThe (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1...5.0 MediumkatelloRed HatForced Browsing in Twisted5.3 MediumkatelloRed HatEval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman...8.8 HighkatelloRed Hatsafemode gem allows context-dependent attackers to obtain sensitive information via the inspect method8.1 HighkatelloRed HatThe Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before...8.8 HighkatelloRed HatBouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain...3.3 LowkatelloRed HatForeman before 1.9.0 allows remote authenticated users with the edit_users permission to edit...6.0 MediumkatelloRed HatForeman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session,...5.0 MediumkatelloRed HatForeman before 1.7.5 allows remote authenticated users to bypass organization and location...4.0 MediumkatelloRed HatForman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in...5.0 MediumkatelloRed HatCross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1...4.3 MediumkatelloRed HatThe ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does...5.9 MediumkatelloRed Hatrest-client Gem Vulnerable to Session Fixation9.8 CriticalkatelloRed Hatrest-client allows local users to obtain sensitive information by reading the log2.1 LowkatelloRed Hatsimplejson before 2.6.1 vulnerable to array index error5.9 MediumkatelloRed HatThe Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute...7.5 HighkatelloRed HatSimpleGeo python-oauth2 does not check the nonce allowing replay attacks4.3 MediumkatelloRed HatForeman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews,...5.0 MediumkatelloRed HatKafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml1.9 LowkatelloRed HatSession fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web...6.8 MediumkatelloRed HatCross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before...4.3 MediumkatelloRed HatMultiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome...10.0 HighkatelloRed HatThe default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote...6.4 MediumkatelloRed HatThe StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16,...7.5 HighkatelloRed Hatwill_paginate Cross-site Scripting vulnerability4.3 MediumkatelloRed HatThe DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22...7.5 HighkatelloRed HatThe DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22...7.5 HighkatelloRed HatMultiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1...7.5 HighkatelloRed HatSimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces5.8 MediumkatelloRed Hatapp/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict...7.5 HighkatelloRed HatThe (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow...5.0 MediumkatelloRed HatEval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1...6.0 MediumkatelloRed HatGoogle V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a...7.5 HighkatelloRed HatApache Tomcat affected by vulnerability in TLS and SSL protocol5.8 Medium