Katello

10 CVEs across 3 Katello products. Browse Katello vulnerabilities, severities, and proof-of-concept exploits.

Katello products with known CVEs

ProductCVEs
Katello9
Katello-Configure1
Katello Installer1
Katello CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2014-0183Medium6.12020-01-02Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
CVE-2013-4120High7.52019-12-10Katello has a Denial of Service vulnerability in API OAuth authentication
CVE-2013-0283Medium5.42019-12-05Katello: Username in Notification page has cross site scripting
CVE-2013-2101Medium5.42019-12-03Katello has multiple XSS issues in various entities
CVE-2013-4201Medium4.32018-05-01Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions.
CVE-2016-3072High8.82016-06-07Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated…
CVE-2014-37122014-11-03Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_cont…
CVE-2013-44552014-05-14Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local…
CVE-2012-61162013-03-01modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows…
CVE-2012-55612013-03-01script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the pa…