CVE-2019-10137

CVE-2019-10137 : A path traversal flaw in spacewalk-proxy (versions up to 2.9) stems from how the proxy processes cached client tokens, allowing a remote, unauthenticated attacker to test for arbitrary files on the proxy filesystem or execute code in the httpd context. Affected: spacewalk-proxy. ...

CVE-2019-10136

CVE-2019-10136 is a Spacewalk vulnerability. The issue arises from Spacewalk (versions up to 2.9) not safely computing client token checksums, allowing an attacker with a valid but expired authenticated header set to rearrange digits and extend session validity without changing the checksum. Publ...

CVE-2017-7470

CVE-2017-7470 : The issue affects Red Hat SUSE-managed Spacewalk infrastructure where the backend component spacewalk-channel (backend/server/rhnChannel.py) fails an authorization check, allowing a non-admin or disabled user to perform administrative tasks. Public references in the provided docum...

CVE-2020-1693

CVE-2020-1693 affects Spacewalk up to version 2.9. It is an XML External Entity (XXE) vulnerability exposed via the /rpc/api endpoint, allowing an unauthenticated remote attacker to read files and potentially trigger a denial of service or, in some cases, execute arbitrary code on the Spacewalk s...

CVE-2014-7811

CVE-2014-7811: Spacewalk and RHN Satellite before 5.7.0 are affected by cross-site scripting via crafted XML data in the REST API. Remote authenticated users can inject arbitrary scripts/HTML. Remediation: upgrade to Spacewalk/RHN Satellite 5.7.0 (per RHSA-2015:0033) or apply related patches. Not...

CVE-2014-7812

CVE-2014-7812 is an XSS vulnerability affecting Spacewalk and Red Hat Network Satellite prior to version 5.7.0. The issue allows remote authenticated users to inject arbitrary web script or HTML via the System Groups field. Affected products include Spacewalk and RHN Satellite (before 5.7.0); rem...

CVE-2011-2919

CVE-2011-2919 is a cross-site scripting (XSS) vulnerability in Spacewalk 1.6 as used with Red Hat Network Satellite. The issue allows a remote attacker to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page. Connected documents corroborate the vulnerability in R...

CVE-2011-3344

CVE-2011-3344 is a cross-site scripting (XSS) flaw in the Spacewalk/RHN Satellite web interface, exposed via the Lookup Login/Password form in Spacewalk 1.6. The root cause is a reflected XSS vulnerability in the URI handling of the RHN Satellite web UI, allowing remote attackers to inject arbitr...

CVE-2011-2920

CVE-2011-2920 corresponds to multiple XSS flaws in Spacewalk 1.6 used by Red Hat Network Satellite. The Spacewalk web interface has vulnerabilities that allow remote attackers to inject arbitrary script/HTML, notably via the Filter by Synopsis field. Public references from SUSE and Red Hat descri...

CVE-2011-1594

CVE-2011-1594 is an Open Redirect in Spacewalk 1.6 used by Red Hat Network Satellite. The flaw allows remote attackers to redirect users to arbitrary sites via the url_bounce parameter, enabling phishing-like redirects. Multiple references (RHSA-2011:1299, SUSE CVE page) indicate an open‑redirect...

CVE-2011-2927

CVE-2011-2927 is an XSS vulnerability affecting Spacewalk 1.6 as used by Red Hat Network Satellite. The issue enables a remote attacker to inject scripts via Search form vectors in the RHN Satellite web interface. Connected sources (SUSE, Red Hat advisory RHSA-2011:1299, Veracode listing) confirm...

CVE-2018-1077

Spacewalk 2.6 contains an XML External Entity (XXE) flaw in its API that can disclose server‑side sensitive information. Public descriptions confirm the CVE‑2018‑1077 issue; remediation in linked SUSE advisories includes disabling external entity parsing and preventing external entity downloads (...