SUSE: Security Advisory (SUSE-SU-2021:14833-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-22868 · Suse +1 · Uyuni +2

Name of the Vulnerable Software and Affected Versions: Spacewalk version 2.10 Uyuni version 2021.08 Uyuni spacewalk-admin versions prior to 4.3.2-1 Description: The issue allows code injection due to the lack of sanitization of the configuration filename used by the rhn-config-satellite.pl script...

Security update for SUSE Manager Client Tools (moderate)

openSUSE Security Update: Security update for SUSE Manager Client Tools Announcement ID: openSUSE-SU-2021:2675-1 Rating: moderate References: 1175478 1186242 1186508 1186581 1186650 1188846 SLE-18254 Cross-References: CVE-2021-27962 CVE-2021-28146 CVE-2021-28147 CVE-2021-28148 CVE-2021-29622 CVSS...

SUSE: Security Advisory (SUSE-SU-2021:14753-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES11 Security Update : SUSE Manager Client Tools (SUSE-SU-2019:14163-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14163-1 advisory. - It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired,...

SUSE: Security Advisory (SUSE-SU-2020:14570-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2020:3781-1 Security update for SUSE Manager Server 4.1

This update fixes the following issues: image-sync-formula: - Send imagesynced event to master postgresql-jdbc: - Address CVE-2020-13692 bsc1172079 pxe-yomi-image-sle15: - Update config.sh based on last JeOS template - Update JEOSLOCALE to enUS.UTF-8 - Support configurlname for user provided...

SUSE Access Control Error Vulnerability

SUSE Manager is a Linux server management system from SUSE Germany. The system provides automated software management, system configuration and monitoring. spacewalk is an open source Linux system management solution. An access control error vulnerability exists in SUSE. The vulnerability arises...

CVE-2020-8028 salt-api is accessible to every user on SUSE Manager Server

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system...

The vulnerability of the /rpc/api component of the Red Hat Spacewalk system management software allows a attacker to disclose sensitive information, cause service failures, or execute arbitrary code.

The vulnerability of the /rpc/api component of the Red Hat Spacewalk software suite relates to incorrect restrictions on XML links to external objects. Exploitation of this vulnerability could allow a malicious actor to disclose sensitive information, cause service failures, or execute arbitrary...

Denial Of Service (DoS)

spacewalk-backend is vulnerable to denial of service. It was found that a remote attacker could upload packages to an RHN Satellite server's NULL organization without any authorization or authentication. The NULL organization stores packages synced from RHN Hosted. Although an attacker cannot put...

Information Disclosure

spacewalk-backend is vulnerable to information disclosure. The vulnerability exists when a user submitted a system registration XML-RPC call to an RHN Satellite server for example, by running "rhnregks" and that call failed, their RHN user password was included in plain text in the error messages...

Cross-site Scripting (XSS)

spacewalk-java is vulnerable to cross-site scripting XSS. The vulnerability exists as a remote attacker could use these flaws to perform a cross-site scripting attack against victims using the RHN Satellite web interface...

Cross-site Scripting (XSS)

spacewalk-web is vulnerable to cross-site scripting XSS. The vulnerability exists as a remote attacker could use these flaws to perform a cross-site scripting attack against victims using the RHN Satellite web interface...

Cross-site Scripting (XSS)

spacewalk-web is vulnerable to cross-site scripting XSS. The vulnerability exists as multiple cross-site scripting XSS flaws were found in the RHN Satellite web interface. A remote attacker could use these flaws to perform a cross-site scripting attack against victims using the RHN Satellite web...

Open Redirect

spacewalk-web is vulnerable to open redirect. The vulnerability exists as a remote attacker able to trick a victim to open the login page using a specially-crafted link could redirect the victim to an arbitrary page after they successfully log in...

Privilege Escalation

spacewalk-java is vulnerable to privilege escalation. The vulnerability exists as it was found that RHN Satellite did not protect against Cross-Site Request Forgery CSRF attacks. If an authenticated RHN Satellite user visited a specially-crafted web page, it could lead to unauthorized command...

Information Disclosure

spacewalk is vulnerable to information disclosure. A flaw was found in the way RHN Satellite Server managed user authentication. A time delay was not inserted after each failed log in, which could allow a remote attacker to conduct a password guessing attack efficiently...

Session Fixation

spacewalk is vulnerable to session fixation. A session fixation flaw was found in the way RHN Satellite Server handled session cookies. An RHN Satellite Server user able to pre-set the session cookie in a victim's browser to a valid value could use this flaw to hijack the victim's session after t...

Authorization Bypass

spacewalk-config is vulnerable to authorization bypass. The vulnerability exists as RHN Satellite incorrectly exposed an obsolete XML-RPC API for configuring package group comps.xml files for channels. An authenticated user could use this flaw to gain access to arbitrary files accessible to the R...