Red Hat Red Hat Satellite 6.19 for RHEL 9
21 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-56098 | corrigé en 0:4.20.0.11-1.el9sat | Rubygem-katello: improper authorization logic allows resource enumeration | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-56097 | corrigé en 0:4.20.0.11-1.el9sat | Rubygem-katello: sql injection in registry proxy via labels | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-12545 | corrigé en 0:3.18.0-2.el9sat | Rubygem-hammer_cli: command injection via insecure editor invocation | MEDIUM 6.7 | 0.5 % | ||
| CVE-2026-12542 | corrigé en 0:3.18.0.14-1.el9sat | Foreman: command injection in foreman-tail | HIGH 7.8 | 0.6 % | ||
| CVE-2026-96659 | | Foreman: excessive permissions for viewer role on preview | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-96658 | | Foreman: foreman: arbitrary code execution via safemode sandbox bypass | HIGH 8.8 | 0.7 % | ||
| CVE-2026-12544 | corrigé en 0:3.18.0.14-1.el9sat | Foreman: ssti and insecure deserialization in foreman-rake configuration | HIGH 7.7 | 0.2 % | ||
| CVE-2026-12541 | corrigé en 0:3.18.0.14-1.el9sat | Foreman: command injection in foreman-rake database tasks | HIGH 8.2 | 1.2 % | ||
| CVE-2026-12540 | corrigé en 0:3.18.0.14-1.el9sat | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter | HIGH 8.2 | 1.2 % | ||
| CVE-2026-12423 | corrigé en 0:3.18.0.14-1.el9sat | Foreman: unauthenticated information disclosure via provisioning token validation flaw | HIGH 7.5 | 0.4 % | ||
| CVE-2026-12405 | corrigé en 0:16.5.3-2.el9sat | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter | HIGH 8.8 | 1.6 % | ||
| CVE-2026-79654 | corrigé en 0:4.20.0.11-1.el9sat | Ketello: katello content view history api cross-organization authorization bypass | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-16493 | corrigé en 1:2.16.19-1.el9sat | Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-12701 | | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-5138 | corrigé en 0:3.18.0.7-1.el9sat | Foreman: foreman: information disclosure via improper validation of nested request parameters | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-5135 | corrigé en 0:3.18.0.7-1.el9sat | Foreman: foreman: unauthorized modification of host configurations via broken access control | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-5142 | corrigé en 0:3.18.0.7-1.el9sat | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-5136 | corrigé en 0:3.18.0.7-1.el9sat | Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation | HIGH 8.8 | 0.6 % | ||
| CVE-2026-12515 | corrigé en 0:4.20.0.7-1.el9sat | Katello: missing repository authorization in content_uploads exposes cross-product content existence | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-11332 | | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-4324 | | Rubygem-katello: katello: denial of service and potential information disclosure via sql injection | MEDIUM 5.4 | 0.3 % |