Red Hat Satellite any version

manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.

Foreman: arbitrary code execution through templates

Arbitrary code execution through yaml global parameters

Foreman: excessive permissions for viewer role on preview

Forman: foreman: remote code execution via command injection in websocket proxy

Foreman: safemode bypass leading to rce

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Rhn-proxy: rhn-satellite: rhn-proxy: information disclosure via clear-text credential transmission when accessing rhn satellite

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Foreman: command injection in foreman-rake database tasks

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Foreman: command injection in foreman-tail

Foreman: ssti and insecure deserialization in foreman-rake configuration

Satellite: arithmetic overflow in satellite

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

Foreman: unauthenticated information disclosure via provisioning token validation flaw

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Foreman: foreman: unauthorized modification of host configurations via broken access control

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

Foreman: foreman: information disclosure via improper validation of nested request parameters