Redhat Subscription Asset Manager — known CVE vulnerabilities

Every CVE whose affected-product data names Redhat Subscription Asset Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2015-7501 — CVSS 9.8 (critical): Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise…
• CVE-2013-6439 — CVSS 9.3 (critical): Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not…
• CVE-2012-6685 — CVSS 7.5 (high): Nokogiri before 1.5.4 is vulnerable to XXE attacks
• CVE-2014-0130 — CVSS 7.5 (high) — actively exploited: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails…
• CVE-2013-6461 — CVSS 6.5 (medium): Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
• CVE-2013-6460 — CVSS 6.5 (medium): Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
• CVE-2014-0026 — CVSS 6.5 (medium): katello-headpin is vulnerable to CSRF in REST API
• CVE-2014-0029 — CVSS 6.1 (medium): Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject…
• CVE-2014-0183 — CVSS 6.1 (medium): Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when…
• CVE-2013-1823 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote…
• CVE-2012-6119 — CVSS 2.1 (low): Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which…