CVE-2021-20260

A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Foreman Information Disclosure Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. An information disclosure vulnerability exists in Foreman project, which can be exploited by a local attacker to expose...

Foreman Security Vulnerabilities

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. Foreman has a security vulnerability that can be exploited by a local attacker to expose passwords...

Information Disclosure

foreman is vulnerable to information disclosre. It is possible due to unauthorized cache read on RPM-based installations through local user...

Information Disclosure

foreman is vulnerable to information disclosure. The form helper does not authorize options for associated objects, allowing users to see the names of such objects...

Authorization Bypass

foreman is vulnerable to authorization bypass. The access to provisioning template previews is not properly restricted, allowing remote attackers to obtain confidential information via the hostname parameter...

Denial Of Service (DoS)

foreman is vulnerable to denial of service. An improper input validation allows an attacker to crash the application...

Cross-Site Scripting (XSS)

foreman is vulnerable to cross-site scripting. A remotely authenticated user is able to inject and execute arbitrary Javascript in another user's browser via the bookmark name...

Exposed API

foreman does not properly restrict access to APIs. A remote attacker is able to access arbitrary hosts via an API request...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...

Information Disclosure

foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

Cross site request forgery (csrf)

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-3590

CVE-2014-3590 affects Foreman as shipped with Red Hat Satellite 6. The logout action does not validate the CSRF token, enabling an attacker to force a user logout by viewing specially crafted content. Connected Red Hat advisory RHSA-2015:1592 documents Foreman-related issues and notes related fix...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-3590: Cross-Site Request Forgery (CSRF)

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-0091

Foreman has improper input validation which could lead to partial Denial of Service...

Input validation

Foreman has improper input validation which could lead to partial Denial of Service...

CVE-2014-0091

The connected documents confirm CVE-2014-0091 affects Foreman, with the underlying issue described as improper input validation that can cause a partial Denial of Service. The sources (NVD, Veracode) consistently report DoS due to input validation problems in Foreman. No concrete vendor/version d...