Code injection

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...

CVE-2012-6119

CVE-2012-6119 concerns Candlepin before 0.7.24 used in Red Hat Subscription Asset Manager before 1.2.1, where manifest signatures were not properly checked, allowing local users to modify manifests. The related VERACODE entries confirm this and tie remediation to the Red Hat 1.2.1 update (RHSA-20...

CVE-2013-1823

Affected software: Red Hat Subscription Asset Manager prior to version 1.2.1. Vulnerability: Cross-site scripting (XSS) in the Notifications form, where HTML in the username field could be injected. The root cause is improper escaping of HTML markup in the username input. Impact: Remote attackers...

CVE-2013-1823

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

PT-2013-3408 · Red Hat · Red Hat Subscription Asset Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Subscription Asset Manager versions prior to 1.2.1 Description: A cross-site scripting XSS issue exists in the Notifications form, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could...

Katello: Notifications page Username XSS

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

Moderate: Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update

Red Hat Subscription Asset Manager 1.2.1, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

RHEL 6 : Subscription Asset Manager (RHSA-2013:0544)

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

RHEL 5 : redhat-release (EOL Notice) (RHSA-2013:0578)

This is the 5-Month notification for the conclusion of Red Hat Enterprise Linux 5.6 Extended Update Support EUS Add-on offering. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the Extended Update Support Add-On for Red Hat Enterprise Linux 5.6 will conclude on July 31, 201...

Important: Red Hat Security Advisory: Subscription Asset Manager 1.2 update

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

[SECURITY] Fedora 17 Update: rubygem-activerecord-3.0.11-6.fc17

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties databa se tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

RHEL 6 : rubygem-activesupport (RHSA-2013:0201)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0201 advisory. Ruby on Rails is a modelviewcontroller MVC framework for web application development. Active Support provides support and utility classes used by the...

CVE-2012-6106

calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object...

RHEL 6 : katello (RHSA-2012:1187)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1187 advisory. Katello allows you to manage the application life-cycle for Linux systems. Katello is used by Red Hat Subscription Asset Manager, a distributor...

RHEL 6 : Ruby on Rails in Subscription Asset Manager (RHSA-2013:0154)

Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scorin...

Fedora Update for rubygem-activerecord FEDORA-2013-0635

Check for the Version of rubygem-activerecord OpenVAS Vulnerability Test Fedora Update for rubygem-activerecord FEDORA-2013-0635 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Fedora Update for rubygem-activerecord FEDORA-2013-0568

Check for the Version of rubygem-activerecord OpenVAS Vulnerability Test Fedora Update for rubygem-activerecord FEDORA-2013-0568 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

The use of passwords in a technological evolution

Every day we read about an incredible number of successful attacks and data breaches that exploited leak of authentication mechanisms practically in every sector. Often also critical control system are exposed on line protected only by a weak password, in many cases the default one of factory...

Calendar Script Easy Membership Management Application Persistent XSS Vulnerability

Exploit for php platform in category web applications Advisory:Calendar Script Easy Membership Management ApplicationE.M.M.A Persistent XSS Vulnerability Version:1.2 Vendor URL: http://calendarscripts.info/emma/ Demo Link: http://demo.pimteam.net/emma/admin.php Author: Viknesvaran Sittaramane...

Calendar Script E.M.M.A 1.2 Cross Site Scripting

Advisory:Calendar Script Easy Membership Management ApplicationE.M.M.A Persistent XSS Vulnerability Version:1.2 Vendor URL: http://calendarscripts.info/emma/ Demo Link: http://demo.pimteam.net/emma/admin.php Author: Viknesvaran Sittaramane Category: Webapp Twiiter: https://twitter.com/csvsn...