Privilege Escalation

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Man-In-The-Middle (MitM)

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Cross-Site Scripting (XSS)

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Arbitrary Code Execution

The Foreman is vulnerable to arbitrary code execution. Due to a flaw found in the create method of the Foreman Bookmarks controller. any user who can create a bookmark can execute malicious code with the privileges of the user running Foreman, giving them control of the system running Foreman and...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

Design/Logic Flaw

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

CVE-2019-3893 affects Foreman: the delete_compute_resource operation via the Foreman API can disclose plaintext passwords/tokens for the affected compute resource. Vulnerable are Foreman versions prior to 1.20.3, 1.21.1, and 1.22.0. A malicious user with the delete_compute_resource permission can...

CVE-2019-3893

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

PT-2019-16758 · Foreman +1 · Foreman +1

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.20.3 Foreman versions prior to 1.21.1 Foreman versions prior to 1.22.0 Description: The delete compute resource operation in Foreman, when executed from the Foreman API, can lead to the disclosure of the plaintext...

CVE-2019-3893: Incorrect Permission Assignment for Critical Resource

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

Authorization

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

CVE-2018-14666

The CVE-2018-14666 describes an improper authorization flaw in the Smart Class feature of Foreman, affecting all Red Hat Satellite 6 versions. The underlying issue allows an attacker to change the configuration of any host registered in Satellite, regardless of organizational boundaries. The impa...

CVE-2018-14666: Improper Authorization

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

Cross-site Scripting (XSS)

foreman is vulnerable to cross-site scripting XSS attacks. The vulnerability exists in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edi...

Cross-site Scripting (XSS)

foreman is vulnerable to cross-site scripting. A remote authenticated attacker is able to inject arbitrary web script or HTML via the network interface device identifier in the host interface form...