994 matches found
Foreman 安全漏洞
Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman that arises from improper authorization handling...
CVE-2021-3469
Foreman is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority CA to sign certificate requests that have subject alternative names SANs. Foreman do not enable SANs by default and...
Foreman 安全漏洞
Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. Foreman has a security vulnerability that can be exploited by an attacker to emulate foreman-proxy...
CVE-2021-20259
A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
CVE-2021-20260
A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with viewhosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
Foreman Security Vulnerabilities
Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. Foreman has a security vulnerability that can be exploited by a local attacker to expose passwords...
Foreman Information Disclosure Vulnerability
Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. An information disclosure vulnerability exists in Foreman project, which can be exploited by a local attacker to expose...
Information Disclosure
foreman is vulnerable to information disclosre. It is possible due to unauthorized cache read on RPM-based installations through local user...
Information Disclosure
foreman is vulnerable to information disclosure. The form helper does not authorize options for associated objects, allowing users to see the names of such objects...
Authorization Bypass
foreman is vulnerable to authorization bypass. The access to provisioning template previews is not properly restricted, allowing remote attackers to obtain confidential information via the hostname parameter...
Denial Of Service (DoS)
foreman is vulnerable to denial of service. An improper input validation allows an attacker to crash the application...
Cross-Site Scripting (XSS)
foreman is vulnerable to cross-site scripting. A remotely authenticated user is able to inject and execute arbitrary Javascript in another user's browser via the bookmark name...
Exposed API
foreman does not properly restrict access to APIs. A remote attacker is able to access arbitrary hosts via an API request...
Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container
Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...
Information Disclosure
foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...
CVE-2014-3590
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
Cross site request forgery (csrf)
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
CVE-2014-3590
CVE-2014-3590 affects Foreman as shipped with Red Hat Satellite 6. The logout action does not validate the CSRF token, enabling an attacker to force a user logout by viewing specially crafted content. Connected Red Hat advisory RHSA-2015:1592 documents Foreman-related issues and notes related fix...
CVE-2014-3590
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...