A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.

A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.

kubeclient: kubeconfig parsing error can lead to MITM attacks openssl: c_rehash script allows command injection openssl: the c_rehash script allows command injection Pulp: Tokens stored in plaintext foreman: OS command injection via ct_command and fcct_command satellite: Blind SSRF via Referer header python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests rubygem-activerecord: Denial of Service rubygem-rack: denial of service in Content-Disposition parsing rubygem-rack: denial of service in Content-Disposition parsing rubygem-rack: denial of service in Content-Disposition parsing ruby-git: code injection vulnerability ruby-git: code injection vulnerability Foreman: Arbitrary code execution through templates Foreman: Stored cross-site scripting in host tab puppet: Puppet Server ReDoS rubygem-actionpack: Denial of Service in Action Dispatch rubygem-activerecord: SQL Injection rubygem-actionpack: Denial of Service in Action Dispatch rubygem-activesupport: Regular Expression Denial of Service rubygem-globalid: ReDoS vulnerability rubygem-rack: Denial of service in Multipart MIME parsing rubygem-rack: denial of service in header parsing golang: net/http: insufficient sanitization of Host header sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) python-django: Potential bypass o…

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Satellite ausnutzen, um Daten zu manipulieren.