Unscored severity · published Apr 2, 2013
CVE-2013-1823
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Subscription Asset Manager · Redhat
through 1.2.0; 1.0.0; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1823
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1823
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0686.html
Vendor Advisory
http://secunia.com/advisories/52774
www.osvdb.org
http://www.osvdb.org/91718
Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=918784
More from Subscription Asset Manager
7.5
CVE-2014-0130
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x…
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
7.5
CVE-2012-6685
Nokogiri before 1.5.4 is vulnerable to XXE attacks
6.5
CVE-2014-0026
katello-headpin is vulnerable to CSRF in REST API
6.5
CVE-2013-6461
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits