katello-headpin is vulnerable to CSRF in REST API

Hui Wang and Keqin Hong of Red Hat report:

SAM web application is vulnerable to cross site scripting. An attacker can use XSS to send the malicious script that will be executed to an unsuspecting user.

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.