foreman: Managing repositories with their id via hammer does not respect the role filters

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter filter set on the Product Name, the filter is not respected when the actions are done via hammer using the repository id...

Cross-Site Scripting (XSS)

katello is vulnerable to cross-site scripting. Multiple XSS in various entities allow an attacker to inject and execute arbitary Javascript in a user's browser...

CVE-2014-0183

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering...

Design/Logic Flaw

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering...

CVE-2014-0183

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering...

CVE-2014-0183

CVE-2014-0183 affects Katello as shipped with Red Hat Subscription Asset Manager 1.4, vulnerable to cross-site scripting via HTML in the system name during registration. Root cause: HTML in system name not properly sanitized. Impact: potential XSS through the registration flow. Exploitation detai...

Katello Resource Management Error Vulnerability

Katello is a system management engine. The product provides workflows for configuration management, subscription management and content management. A resource management error vulnerability exists in API Oauth authentication in Katello. The vulnerability stems from mismanagement of system resourc...

CVE-2014-0026

katello-headpin is vulnerable to CSRF in REST API...

Cross site request forgery (csrf)

katello-headpin is vulnerable to CSRF in REST API...

CVE-2014-0026

katello-headpin is vulnerable to CSRF in REST API...

CVE-2014-0026

CVE-2014-0026 applies to katello-headpin and is due to a CSRF vulnerability in the REST API. The issue is listed with CVSS vectors (2.0: AV:N/AC:M/Au:N/C:N/I:P/A:N; 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicating network access, no confidentiality impact, partial integrity impact, a...

CVE-2013-4120

Katello has a Denial of Service vulnerability in API OAuth authentication...

Authentication flaw

Katello has a Denial of Service vulnerability in API OAuth authentication...

CVE-2013-4120

Katello has a Denial of Service vulnerability in API OAuth authentication...

CVE-2013-4120

CVE-2013-4120 pertains to Katello with a Denial of Service vulnerability in the API OAuth authentication mechanism. The initial sources describe a DoS condition without detailing specific vulnerable versions, affected modules, or exact root cause. The CVSS metrics included show a network-exposed,...

Katello Cross-Site Scripting Vulnerability (CNVD-2019-44962)

Katello is a system management engine. The product provides workflows for configuration management, subscription management and content management. A cross-site scripting vulnerability exists in the Username of the Notification page in Katello. The vulnerability stems from the WEB application's...

CVE-2013-0283

Katello: Username in Notification page has cross site scripting...

Cross site scripting

Katello: Username in Notification page has cross site scripting...

CVE-2013-0283

Katello: Username in Notification page has cross site scripting...

CVE-2013-0283

Katello contains a cross-site scripting (XSS) vulnerability in the Username field of the Notification page. The issue arises from insufficient validation of client-side data, allowing potential execution of malicious code. Affected component: Katello (Notification page username). Root cause: lack...