Authorization

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-3589

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-3589

CVE-2021-3589 describes an authorization flaw in Foreman Ansible where an authenticated user with certain permissions to create/run Ansible jobs can bypass security and access hosts via job templates. The issue is triggered by sending a crafted request, potentially impacting confidentiality, inte...

PT-2022-10476 · Unknown · Foreman Ansible

Name of the Vulnerable Software and Affected Versions: Foreman Ansible affected versions not specified Description: An authorization flaw was found, allowing an authenticated attacker with certain permissions to create and run Ansible jobs to access hosts through job templates. This poses a threa...

Foreman 访问控制错误漏洞

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman Ansible where an authenticated attacker with specific...

Foreman < 2.4.1, 2.5.x < 2.5.1 RCE Vulnerability

Foreman is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:theforeman:foreman...

CVE-2021-3584

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...

CVE-2021-3584

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...

Remote code execution

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...

CVE-2021-3584

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...

CVE-2021-3584

CVE-2021-3584 is a server-side remote code execution in the Foreman project. An authenticated attacker can abuse Sendmail configuration options to overwrite defaults and perform command injection, impacting confidentiality, integrity, and availability. According to the primary sources, fixed rele...

PT-2021-21064 · Foreman +2 · Foreman +2

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.4.1 Foreman versions prior to 2.5.1 Foreman versions prior to 3.0.0 Description: A server-side remote code execution issue was found in the Foreman project. An authenticated attacker could use Sendmail configuratio...

Man-In-The-Middle Attack (MitM)

foreman is vulnerable to man-in-the-middle attack. The vulnerability exists due to the FreeIPA module of Foreman smart proxy does not check the SSL certificate...

foreman: possible man-in-the-middle in smart_proxy realm_freeipa

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if...

Moderate: Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CVE-2021-3584

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability o...

Foreman 操作系统命令注入漏洞

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. An operating system command injection vulnerability exists in Foreman, which allows an authenticated attacker to override...

Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of...

GHSA-F2RP-4RV7-FC95 Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of...

Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions...