hammer_cli_foreman Improper Certificate Validation vulnerability

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks...

foreman: Managing repositories with their id via hammer does not respect the role filters

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter filter set on the Product Name, the filter is not respected when the actions are done via hammer using the repository id...

Denial of Service Vulnerability in Hammer Tech's Nut Pro 2 Phone

The Nut Pro 2 is a new phone announced by Hammer Technology on November 7, 2017 at the 2017 Hammer Technology Fall Launch Event. A denial of service vulnerability exists in the Hammer Tech Nut Pro 2 phone, which can be exploited by an attacker to consume system and device resources, causing the...

Node.js third-party modules: Prototype pollution in multipart parsing

I would like to report a prototype pollution attack in fastify-multipart it allows to crash a remote server parsing multipart requests by sending a specially crafted request. Module module name: fastify-multipart version: all versions before Detailed steps to reproduce with all required...

PT-2019-7043

Name of the Vulnerable Software and Affected Versions rubygem-hammer cli foreman affected versions not specified Description The issue is related to a file permission problem, where the file /etc/hammer/cli.modules.d/foreman.yml is world readable. This could potentially allow unauthorized access ...

CVE-2014-0241: Insufficiently Protected Credentials

rubygem-hammercliforeman: File /etc/hammer/cli.modules.d/foreman.yml world readable...

Dow Jones Hammer - Protect The Cloud With The Power Of The cloud(AWS)

Dow Jones Hammer is a multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources, across all regions and accounts. It has near real-time reporting capabilities e.g. JIRA, Slack to provide quick feedback to engineers and...

Authorization Bypass

katello is vulnerable to authorization bypasses. The library does not properly enforce filters on a repository, allowing a malicious user to gain access to sensitive information on the repository through hammer cli commands...

CVE-2017-2662

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter filter set on the Product Name, the filter is not respected when the actions are done via hammer using the repository id...

PT-2018-7165 · Foreman · Foreman +1

Name of the Vulnerable Software and Affected Versions: Foreman's katello plugin version 3.4.5 Description: A flaw was found in Foreman's katello plugin. The issue occurs when a new role is set to allow restricted access on a repository with a filter, specifically a filter set on the Product Name...

CVE-2017-2662: Missing Authorization

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter filter set on the Product Name, the filter is not respected when the actions are done via hammer using the repository id...

Design/Logic Flaw

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

CVE-2018-1000620

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

CVE-2018-1000620

CVE-2018-1000620 : Eran Hammer cryptiles 4.1.1 contains a CWE-331 Insufficient Entropy flaw in randomDigits(), enabling brute-force guessing of randomness. IBM/Oracle-style bulletin confirms the issue and notes it is fixed in 4.1.2; remediation is to upgrade to 4.1.2 (or move to maintained packag...

CVE-2018-1000620

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

CVE-2018-1000620: Insufficient Entropy

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the...

Default configuration

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks...

CVE-2017-2667

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks...

CVE-2017-2667

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks...

CVE-2017-2667

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks...