CVE-2013-6439

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

Authentication flaw

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

CVE-2013-6439

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

CVE-2013-6439

CVE-2013-6439 affects Red Hat Subscription Asset Manager Candlepin 1.0–1.3, which uses a weak authentication scheme when the configuration file does not specify a scheme. Public sources reiterate an authentication-bypass risk. Remediation involves applying the updated candlepin packages from RHSA...

candlepin: insecure authentication enabled by default

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

Important: Red Hat Security Advisory: candlepin security update

Updated candlepin packages that fix one security issue are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2013-3281

The CVE-2013-3281 entry describes a cross-site scripting (XSS) vulnerability in EMC Documentum products (Webtop, WDK, Taskspace, Records Manager, Web Publisher, Digital Asset Manager, Administrator, Capital Projects) prior to the stated SP versions. The flaw allows remote attackers to inject arbi...

RHEL 6 : Subscription Asset Manager (RHSA-2013:0686)

Red Hat Subscription Asset Manager 1.2.1, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

CVE-2013-1823

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2012-6119

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...

Cross site scripting

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

Code injection

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...

CVE-2013-1823

Affected software: Red Hat Subscription Asset Manager prior to version 1.2.1. Vulnerability: Cross-site scripting (XSS) in the Notifications form, where HTML in the username field could be injected. The root cause is improper escaping of HTML markup in the username input. Impact: Remote attackers...

CVE-2012-6119

CVE-2012-6119 concerns Candlepin before 0.7.24 used in Red Hat Subscription Asset Manager before 1.2.1, where manifest signatures were not properly checked, allowing local users to modify manifests. The related VERACODE entries confirm this and tie remediation to the Red Hat 1.2.1 update (RHSA-20...

CVE-2013-1823

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

PT-2013-3408 · Red Hat · Red Hat Subscription Asset Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Subscription Asset Manager versions prior to 1.2.1 Description: A cross-site scripting XSS issue exists in the Notifications form, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could...

Moderate: Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update

Red Hat Subscription Asset Manager 1.2.1, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

RHEL 6 : Subscription Asset Manager (RHSA-2013:0544)

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

Important: Red Hat Security Advisory: Subscription Asset Manager 1.2 update

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

RHEL 6 : rubygem-activesupport (RHSA-2013:0201)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0201 advisory. Ruby on Rails is a modelviewcontroller MVC framework for web application development. Active Support provides support and utility classes used by the...