Red Hat Subscription Asset Manager vulnerabilities
11 CVEs affecting Red Hat Subscription Asset Manager, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-6685, published 2020-02-19.
More from Red Hat.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2014-0130: Ruby on Rails Directory Traversal Vulnerability, published 2014-05-07. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 53.7% chance of exploitation in the next 30 days. Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when…
- CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
- CVE-2013-6461, published 2019-11-05. Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days. Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
- CVE-2012-6685, published 2020-02-19. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Nokogiri before 1.5.4 is vulnerable to XXE attacks
- CVE-2013-6460, published 2019-11-05. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
- CVE-2013-1823, published 2013-04-02. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username…
- CVE-2013-6439, published 2013-12-23. High severity, CVSS 9.3. EPSS: 1.6% chance of exploitation in the next 30 days. Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack…
- CVE-2014-0029, published 2017-10-16. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- CVE-2014-0183, published 2020-01-02. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
- CVE-2014-0026, published 2019-12-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. katello-headpin is vulnerable to CSRF in REST API