1318 matches found
CVE-2013-4180
The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...
CVE-2013-4182
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
Cross site request forgery (csrf)
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
CVE-2013-4180
The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...
CVE-2013-4182
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
CVE-2013-4180
The CVE-2013-4180 issue affects Foreman prior to 1.2.2, where the HostController’s power and ipmi_boot actions allow remote attackers to trigger a denial-of-service via input converted to a symbol, causing memory consumption. Affected version range is Foreman
CVE-2013-4180
The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...
CVE-2013-4182
CVE-2013-4182 affects Foreman prior to 1.2.2, specifically the API at /api/v1/hosts handled by hosts_controller.rb, where access checks were insufficient. This allowed remote attackers to access arbitrary hosts via the API request. The publicly documented remediation is to upgrade to Foreman 1.2....
CVE-2013-4182
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
CVE-2013-4180: Improper Input Validation
The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...
PT-2013-4888 · Foreman · Foreman
Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.2.2 Description: The issue allows remote attackers to cause a denial of service, specifically memory consumption, via unspecified input that is converted to a symbol. This is related to the power and ipmi boot...
PT-2013-4890 · Foreman · Foreman
Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.2.2 Description: The issue is related to improper access restriction to hosts in the Foreman application. This allows remote attackers to access arbitrary hosts via an API request to the /api/v1/hosts endpoint, whi...
CVE-2013-4182: Undefined Security Weakness
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
Foreman: hosts_controller.rb power/ipmi_boot Symbol creation DoS
The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...
foreman: app/controllers/api/v1/hosts_controller.rb API privilege escalation
app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...
Important: Red Hat Security Advisory: Foreman security update
Updated Foreman packages that fix two security issues are now available for Red Hat OpenStack 3.0. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are availabl...
Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment
This Metasploit module exploits a mass assignment vulnerability in the create action of users controller of Foreman and Red Hat OpenStack/Satellite Foreman 1.2.0-RC1 and earlier by creating an arbitrary administrator account. For this exploit to work, your account must have createusers permission...
Foreman (RedHat OpenStack/Satellite) - users/create Mass Assignment (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4 'Foreman Red Hat OpenStack/Satellite...
Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4 'Foreman Red Hat OpenStack/Satellite...
CVE-2013-2113
The create method in app/controllers/userscontroller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by 1 changing the admin flag or 2 assigning an arbitrary role...