Cross-Site Scripting (XSS)

foreman is vulnerable to cross-site scripting. A remotely authenticated user is able to inject and execute arbitrary Javascript in another user's browser via the bookmark name...

Exposed API

foreman does not properly restrict access to APIs. A remote attacker is able to access arbitrary hosts via an API request...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...

Information Disclosure

foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

Cross site request forgery (csrf)

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-3590

CVE-2014-3590 affects Foreman as shipped with Red Hat Satellite 6. The logout action does not validate the CSRF token, enabling an attacker to force a user logout by viewing specially crafted content. Connected Red Hat advisory RHSA-2015:1592 documents Foreman-related issues and notes related fix...

CVE-2014-3590

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

CVE-2014-0091

Foreman has improper input validation which could lead to partial Denial of Service...

Input validation

Foreman has improper input validation which could lead to partial Denial of Service...

CVE-2014-0091

Foreman has improper input validation which could lead to partial Denial of Service...

CVE-2014-0091

The connected documents confirm CVE-2014-0091 affects Foreman, with the underlying issue described as improper input validation that can cause a partial Denial of Service. The sources (NVD, Veracode) consistently report DoS due to input validation problems in Foreman. No concrete vendor/version d...

foreman: authorization bypasses in foreman-tasks leading to information disclosure

An authentication bypass vulnerability was discovered in Foreman. Previously, commit tasks were searched through findresource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover ...

foreman: Recover of plaintext password or token for the compute resources

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

CVE-2018-1097

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource...

The vulnerability affects the implementation of the Smart Class class in the software for managing Red Hat Satellite systems, as well as the Foreman application for managing, configuring, and monitoring servers. This allows a malicious individual to modify the configuration files.

The vulnerability of the Smart Class class implementation in the software for managing Red Hat Satellite systems, as well as the Foreman management, configuration, and monitoring application, is related to improper authentication. Exploiting this vulnerability allows a malicious actor to remotely...

CVE-2014-8183

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

Design/Logic Flaw

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

CVE-2014-8183

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

CVE-2014-8183

CVE-2014-8183 affects Foreman in Red Hat Satellite 6.x (Foreman 1.x.x before 1.15.6). The root cause is improper enforcement of access controls on certain resources via the API, allowing an attacker with API access and knowledge of a resource name to access resources in other organizations. The R...