Foreman Cross-Site Scripting Vulnerability (CNVD-2017-30365)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in Foreman 1.7.0 and later versions. A remote attacker can...

Authentication flaw

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

Technical details about CVE-2015-5246 are not publicly available in the provided connected documents. The sources summarize an LDAP authentication issue in Foreman but do not specify affected versions, exploit methods, or fixes. Monitor for updates.

CVE-2015-5282

Cross-site scripting XSS vulnerability in Foreman 1.7.0 and after...

Cross site scripting

Cross-site scripting XSS vulnerability in Foreman 1.7.0 and after...

CVE-2015-5282

Cross-site scripting XSS vulnerability in Foreman 1.7.0 and after...

CVE-2015-5282

Foreman (versions 1.7.0 and later) has a documented Cross‑Site Scripting (XSS) vulnerability that allows a remote attacker to execute HTML. The CNVD entry notes Foreman 1.7.0+ is affected and references a commit (4f3555b217be8723e8045f9816d147b5f684ec57) as part of the fix, indicating a remediati...

CVE-2014-8183

It was found that foreman in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

Foreman Redirect Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman, which is caused by the program failing to redirect HTTP...

Foreman rubygem-safemode security bypass vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in rubygem-safemode in Foreman 1.3.2 and earlier versions. An attacker c...

Privilege escalation

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation...

CVE-2017-7540

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation...

CVE-2017-7540

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation...

CVE-2017-7540

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation...

CVE-2017-7540

The CVE-2017-7540 entry concerns rubygem-safemode used by Foreman up to v1.3.2. Concrete details in connected documents indicate a bypass of safe mode restrictions via special Ruby syntax, allowing deletion of objects without delete permissions and potential privilege escalation. Affected compone...

CVE-2017-7540

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation...

CVE-2016-4996

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, ...

CVE-2016-4996

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, ...