It has been discovered that redhat-certification is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory, through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensible information.

It has been discovered that redhat-certification does not properly sanitize paths in rhcertStore.py:saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.

It was discovered that redhat-certification allows an unauthenticated user to download any file accessible by the user running the httpd server, through the /download URL.

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host.

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.

It has been discovered that the /configuration view of redhat-certification does not perform an authorization check and it allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system, even if not belonging to him.

An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded in DocumentBase:loadFiltered in the documentbase.py file. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.