Katello
10 CVEs across 3 Katello products. Browse Katello vulnerabilities, severities, and proof-of-concept exploits.
Katello products with known CVEs
Katello CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2014-0183 | Medium | 6.1 | 2020-01-02 | Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering. |
CVE-2013-4120 | High | 7.5 | 2019-12-10 | Katello has a Denial of Service vulnerability in API OAuth authentication |
CVE-2013-0283 | Medium | 5.4 | 2019-12-05 | Katello: Username in Notification page has cross site scripting |
CVE-2013-2101 | Medium | 5.4 | 2019-12-03 | Katello has multiple XSS issues in various entities |
CVE-2013-4201 | Medium | 4.3 | 2018-05-01 | Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions. |
CVE-2016-3072 | High | 8.8 | 2016-06-07 | Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated… |
CVE-2014-3712 | | | 2014-11-03 | Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_cont… |
CVE-2013-4455 | | | 2014-05-14 | Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local… |
CVE-2012-6116 | | | 2013-03-01 | modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows… |
CVE-2012-5561 | | | 2013-03-01 | script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the pa… |