Cross-site Scripting (XSS)

spacewalk-java is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network RHN Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not...

Cross-site Scripting (XSS)

spacewalk is vulnerable to cross-site scripting XSS. A remote authenticated user is able to inject arbitrary Javascript into another user's by creating a malicious note containing Javascript code, which will execute when viewed and loaded on the victim's browser...

Information Disclosure

spacewalk-backend is vulnerable to information disclosure attacks. The vulnerability exists as the Inter-Satellite Sync ISS operation in Red Hat Network RHN Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skippi...

CVE-2017-7470

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

CVE-2017-7470

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

Authorization

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

CVE-2017-7470

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

CVE-2017-7470

CVE-2017-7470 : The issue affects Red Hat SUSE-managed Spacewalk infrastructure where the backend component spacewalk-channel (backend/server/rhnChannel.py) fails an authorization check, allowing a non-admin or disabled user to perform administrative tasks. Public references in the provided docum...

CVE-2017-7470: Incorrect Authorization

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...

SUSE-SU-2018:1751-1 Security update for SUSE Manager Server 3.1

This update provides the following fixes and improvements for SUSE Manager Server 3.1: The following new package has been added: py26-compat-salt: This package provides compatibility with Python 2.6 for salt. This update includes the following new features: fate325476 Additonally, the following...

Red Hat Spacewalk XML External Entity Injection Vulnerability

Red Hat Spacewalk is the United States Red Hat Red Hat, Inc. based on the Red Hat Network Satellite a set of system management platform and the development of open source Linux system management solutions. The solution provides statistical system information, install and update software, collect...

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

Design/Logic Flaw

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

CVE-2018-1077

Spacewalk 2.6 contains an XML External Entity (XXE) flaw in its API that can disclose server‑side sensitive information. Public descriptions confirm the CVE‑2018‑1077 issue; remediation in linked SUSE advisories includes disabling external entity parsing and preventing external entity downloads (...

CVE-2018-1077

Spacewalk includes an API endpoint that can be abused by attackers to execute an XXE XML External Entity Reference allowing for the disclosure of potentially sensitive information...

CVE-2018-1077: Improper Restriction of XML External Entity Reference

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server...

SUSE-SU-2018:0552-1 Security update for SUSE Manager Server 3.1

This update fixes the following issues: nutch: - Fix hadoop log dir. bsc1061574 osad, rhnlib: - Fix update mechanism when updating the updateservice bsc1073619 pxe-default-image: - Spectre and Meltdown mitigation. CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, bsc1068032 spacecmd: - Support multipl...

Red Hat spacewalk-backend security bypass vulnerability

spacewalk is an open source free linux system management solution. It can be used to manage system information , install and update the software in the system , collect and distribute customized packages in the system to manageable groups , provide and manage configuration files in the system and...