Katello records
6 published records for vendor Katello.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 33.3%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-264 Permissions, Privileges, and Access Controls2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-275 Permission Issues1
- CWE-399 Resource Management Errors1
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
36Monitor | CVE-2016-3072No exploit | Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow rekatello · katello · CWE-89 | High8.8 | 1.8%Jun 7, 2016 |
20Monitor | CVE-2014-3712No exploit | Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in katello · katello · CWE-399 | Medium5.0 | 1.6%Nov 3, 2014 |
17Monitor | CVE-2013-4201No exploit | Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissionkatello · katello · CWE-275 | Medium4.3 | 0.7%May 1, 2018 |
8Monitor | CVE-2013-4455No exploit | Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, katello · katello installer · CWE-264 | Low2.1 | 0.4%May 14, 2014 |
8Monitor | CVE-2012-5561No exploit | script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local usekatello · katello · CWE-200 | Low2.1 | 0.3%Mar 1, 2013 |
8Monitor | CVE-2012-6116No exploit | modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrakatello · katello · CWE-264 | Low2.1 | 0.2%Mar 1, 2013 |
- CVE-2016-307236Monitor
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow re
HighCVSS 8.8No exploitEPSS 1%katello · katelloJun 7, 2016
- CVE-2014-371220Monitor
Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in
MediumCVSS 5.0No exploitEPSS 1%katello · katelloNov 3, 2014
- CVE-2013-420117Monitor
Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permission
MediumCVSS 4.3No exploitEPSS 0%katello · katelloMay 1, 2018
- CVE-2013-44558Monitor
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node,
LowCVSS 2.1No exploitEPSS 0%katello · katello installerMay 14, 2014
- CVE-2012-55618Monitor
script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local use
LowCVSS 2.1No exploitEPSS 0%katello · katelloMar 1, 2013
- CVE-2012-61168Monitor
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstra
LowCVSS 2.1No exploitEPSS 0%katello · katelloMar 1, 2013