Foreman Safemode Rails Controller Information Disclosure Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman version 1.x that stems from an error in the Safemode gem...

Foreman Unauthorized Operation Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman versions prior to 1.8.4 and 1.9.x prior to 1.9.1, which stems...

CVE-2015-5233

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows 1 remote authenticated users with the viewreports permission to read reports from arbitrary hosts or 2 remote authenticated users with the destroyreports permission to delete reports from arbitra...

Code injection

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows 1 remote authenticated users with the viewreports permission to read reports from arbitrary hosts or 2 remote authenticated users with the destroyreports permission to delete reports from arbitra...

CVE-2015-5233

Foreman is vulnerable due to improper enforcement of the view_hosts permission in versions before 1.8.4 and 1.9.x before 1.9.1. This allows remote authenticated users with read access to reports (view_reports) to read reports from arbitrary hosts, and users with delete access (destroy_reports) to...

CVE-2015-5233

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows 1 remote authenticated users with the viewreports permission to read reports from arbitrary hosts or 2 remote authenticated users with the destroyreports permission to delete reports from arbitra...

PT-2016-3676 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions 1.8.0 through 1.8.3 Foreman versions 1.9.0 through 1.9.0 Description: The issue allows remote authenticated users with the view reports permission to read reports from arbitrary hosts or remote authenticated users with the...

Foreman Bookmark Access Security Bypass Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. An error in Foreman's handling of bookmarks associated with the Administer - Bookmarks feature can be exploited by a remote attacker to bypass security restrictions and gain access to other users' restricted...

OracleVM 3.3 : sos (OVMSA-2016-0011)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add vendor, vendor URL info for Oracle Linux orabug 17656507 - Direct traceroute to linux.oracle.com John Haxby orabug 11713272 - Check oraclelinux-release instead of redhat-release to get OS version...

Foreman跨站脚本漏洞（CNVD-2015-08438）

No description provided by source...

Foreman cross-site scripting vulnerability (CNVD-2015-08438)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. A cross-site scripting vulnerability exists in the Foreman information pop-up box, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain...

CVE-2015-7518

Multiple cross-site scripting XSS vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edit forms...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edit forms...

CVE-2015-7518

Multiple cross-site scripting XSS vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edit forms...

CVE-2015-7518

CVE-2015-7518 describes multiple XSS vulnerabilities in Foreman prior to 1.10.0. The issue affects information popups and can be triggered via (1) global parameters, (2) smart class parameters, or (3) smart variables in the host or hostgroup edit forms, enabling remote attackers to inject arbitra...

PT-2015-7560 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.10.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML via global parameters, smart class parameters, or smart variables in the host or hostgroup edit forms, potentially leading ...

Moderate: Red Hat Security Advisory: Satellite 6.1.5 bug fix update

Updated Satellite 6.1 packages that fix one security issue, add one enhancement, and fix several bugs are available for Satellite 6.1.5. Red Hat Product Security has rated this update as having Moderate Security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

foreman: reports show/destroy not restricted by host authorization

A flaw was discovered where Satellite failed to properly enforce permissions on the show and delete actions for reports. An authenticated user with show or delete report permissions could use this flaw to view or delete any reports held in Foreman...

RHEL 7 : Red Hat Ceph Storage 1.3.1 (RHSA-2015:2066)

Red Hat Ceph Storage 1.3.1 that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 1.3.1 security, bug fix, and enhancement update

Red Hat Ceph Storage 1.3.1 that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...