CVE-2016-2104
Fixed in a distro release EPSS 1%
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) search_subscribed_channels, or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.
Products: redhat satellite
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat network satellite 5.7 | spacewalk-java | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-config | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-lib | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-oracle | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-postgresql | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-taskomatic | 0:2.3.8-134.el6sat |
| SUSE Manager 2.1 | cobbler | 2.2.2-0.61.2 |
| SUSE Manager 2.1 | osad | 5.11.33.11-15.2 |
| SUSE Manager 2.1 | rhnlib | 2.5.69.8-11.2 |
| SUSE Manager 2.1 | spacewalk-backend | 2.1.55.25-24.5 |
| SUSE Manager 2.1 | spacewalk-branding | 2.1.33.16-18.2 |
| SUSE Manager 2.1 | spacewalk-certs-tools | 2.1.6.10-18.3 |
| SUSE Manager 2.1 | spacewalk-java | 2.1.165.23-20.1 |
| SUSE Manager 2.1 | spacewalk-utils | 2.1.27.15-12.7 |
| SUSE Manager 2.1 | suseRegisterInfo | 2.1.12-14.2 |
| SUSE Manager 2.1 | susemanager | 2.1.24-23.1 |
| SUSE Manager 2.1 | susemanager-sync-data | 2.1.15-30.2 |
| SUSE Manager 2.1 | susemanager-tftpsync | 2.1.2-11.2 |