Foreman Smart-Proxy TFTP Remote Command Injection

The remote web server is running a version of Foreman Smart-Proxy TFTP that is affected by a remote command injection vulnerability. An attacker can send a specially crafted URL that results in the execution of arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Foreman Smart-Proxy TFTP Detection

Binary data foremansmartproxytftpdetect.nbin...

CVE-2014-3492

Multiple cross-site scripting XSS vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter 1 name or 2 value related to the host...

CVE-2014-3491

Cross-site scripting XSS vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes...

Cross site scripting

Cross-site scripting XSS vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter 1 name or 2 value related to the host...

CVE-2014-3491

Cross-site scripting XSS vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes...

CVE-2014-3491

The CVE-2014-3491 issue is a Cross-site Scripting (XSS) in Foreman before 1.4.5 and in 1.5.x before 1.5.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the Name field on the New Host groups page, tied to create, update, and destroy notification boxes. Affec...

CVE-2014-3492

Foreman contains cross-site scripting (XSS) vulnerabilities in the host YAML view. The issue affects Foreman versions prior to 1.4.5 and 1.5.x prior to 1.5.1, allowing an attacker to inject arbitrary script or HTML via the host-related parameters (name or value). The root cause is not detailed in...

CVE-2014-3492

Multiple cross-site scripting XSS vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter 1 name or 2 value related to the host...

Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4...

CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...

Directory traversal

Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the dst parameter to tftp/fetchbootfile...

Design/Logic Flaw

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...

CVE-2014-0007

CVE-2014-0007 affects Foreman’s Smart-Proxy TFTP module. The Smart-Proxy before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file. Impact per sources indicates remote command execution; attesta...

CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...

CVE-2014-4507

CVE-2014-4507 concerns a directory traversal in the Smart-Proxy component of Foreman, affecting Foreman’s Smart-Proxy before 1.4.5 and 1.5.x before 1.5.1. The flaw lets an attacker supply a .. (dot dot) in the dst parameter to tftp/fetch_boot_file to overwrite arbitrary files on the affected syst...

PT-2014-3429 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.5 Foreman versions 1.5.x prior to 1.5.1 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to the "tftp/fetch boot file" endpoint...

Critical: Red Hat Security Advisory: foreman-proxy security update

An updated foreman-proxy package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 3.0 and 4.0. The Red Hat Security Response Team has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which...

foreman-proxy: smart-proxy remote command injection

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...