CVE-2012-6149

Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.

• CWE-79

• http://rhn.redhat.com/errata/RHSA-2014-0148.htmlVendor Advisory
• http://secunia.com/advisories/56952Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=882000Issue Tracking, Vendor Advisory
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13fPatch, Third Party Advisory
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=1d0f4b4a78ea03d9f2d05fbd52236b1f2ab68e85Exploit, Patch
• https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0148.htmlVendor Advisory
• http://secunia.com/advisories/56952Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=882000Issue Tracking, Vendor Advisory
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13fPatch, Third Party Advisory
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=1d0f4b4a78ea03d9f2d05fbd52236b1f2ab68e85Exploit, Patch
• https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.htmlVendor Advisory

Published

Feb 14, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-6143Spoon::Cookie in the Spoon module 0.24 for Perl does not pro…
• CVE-2012-6144SQL injection vulnerability in the Backend History module in…
• CVE-2012-6145Cross-site scripting (XSS) vulnerability in the Backend Hist…
• CVE-2012-6146The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6…
• CVE-2012-6147Cross-site scripting (XSS) vulnerability in the tree render …
• CVE-2012-6148Cross-site scripting (XSS) vulnerability in the function men…
• CVE-2012-6150The winbind_name_list_to_sid_string_list function in nsswitc…
• CVE-2012-6151Net-SNMP 5.7.1 and earlier, when AgentX is registering to ha…
• CVE-2012-6152The Yahoo! protocol plugin in libpurple in Pidgin before 2.1…
• CVE-2012-6153http/conn/ssl/AbstractVerifier.java in Apache Commons HttpCl…
• CVE-2012-6154Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2012-6155Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…