Total
68 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2016-2100 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.5 MEDIUM | 5.4 MEDIUM |
Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission. | |||||
CVE-2014-3653 | 1 Theforeman | 1 Foreman | 2023-12-10 | 4.3 MEDIUM | N/A |
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template. | |||||
CVE-2016-6320 | 1 Theforeman | 1 Foreman | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form. | |||||
CVE-2016-3728 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.8 MEDIUM | 8.8 HIGH |
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/. | |||||
CVE-2015-5233 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2023-12-10 | 6.0 MEDIUM | 4.2 MEDIUM |
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs. | |||||
CVE-2015-3235 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.0 MEDIUM | N/A |
Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors. | |||||
CVE-2015-1844 | 1 Theforeman | 1 Foreman | 2023-12-10 | 4.0 MEDIUM | N/A |
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API. | |||||
CVE-2016-4475 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.5 MEDIUM | 8.8 HIGH |
The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors. | |||||
CVE-2014-0090 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.8 MEDIUM | N/A |
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie. | |||||
CVE-2014-0192 | 1 Theforeman | 1 Foreman | 2023-12-10 | 5.0 MEDIUM | N/A |
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof." | |||||
CVE-2014-3691 | 2 Redhat, Theforeman | 2 Openstack, Foreman | 2023-12-10 | 7.5 HIGH | N/A |
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate. | |||||
CVE-2014-3492 | 1 Theforeman | 1 Foreman | 2023-12-10 | 4.3 MEDIUM | N/A |
Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host. | |||||
CVE-2013-0187 | 1 Theforeman | 1 Foreman | 2023-12-10 | 6.5 MEDIUM | N/A |
Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request. | |||||
CVE-2013-0173 | 1 Theforeman | 1 Foreman | 2023-12-10 | 5.0 MEDIUM | N/A |
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack. | |||||
CVE-2014-0089 | 1 Theforeman | 1 Foreman | 2023-12-10 | 4.3 MEDIUM | N/A |
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark. | |||||
CVE-2012-5477 | 1 Theforeman | 1 Foreman | 2023-12-10 | 3.6 LOW | N/A |
The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors. | |||||
CVE-2013-0171 | 1 Theforeman | 1 Foreman | 2023-12-10 | 7.5 HIGH | N/A |
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API. | |||||
CVE-2014-3491 | 1 Theforeman | 1 Foreman | 2023-12-10 | 4.3 MEDIUM | N/A |
Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes. | |||||
CVE-2013-0210 | 1 Theforeman | 1 Foreman | 2023-12-10 | 7.5 HIGH | N/A |
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands. | |||||
CVE-2012-5648 | 1 Theforeman | 1 Foreman | 2023-12-10 | 7.5 HIGH | N/A |
Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism. |