Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

An improper access control flaw was found in Candlepin

A flaw was found in satellite

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting)

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…

An authorization flaw was found in Foreman Ansible

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional…

Foreman: command injection in foreman-tail

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database

Foreman: ssti and insecure deserialization in foreman-rake configuration

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security)

Foreman: unauthenticated information disclosure via provisioning token validation flaw

An arithmetic overflow flaw was found in Satellite when creating a new personal access token

An account takeover flaw was found in Red Hat Satellite 6.7.2 onward

Nokogiri before 1.5.4 is vulnerable to XXE attacks

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes

A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String…

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security)

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there…

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX)

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths

A server side remote code execution vulnerability was found in Foreman project

An improper authorization flaw was found in the Smart Class feature of Foreman

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted…

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private…

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in,…

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS)

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute…

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup