1002 matches found
CVE-2014-3653
Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...
CVE-2014-3653
CVE-2014-3653 is an XSS vulnerability in Foreman’s template preview function prior to 1.6.1, allowing a remote attacker to inject arbitrary script/HTML via a crafted provisioning template. Impact is cross-site scripting in the affected web UI; remediation is to upgrade to Foreman 1.6.1 or later a...
Authentication flaw
Smart Proxy aka Smart-Proxy and foreman-proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate...
CVE-2014-3691
Foreman/foreman-proxy is affected by CVE-2014-3691 due to failure to validate SSL certificates in SSL-enabled mode, allowing remote attackers to bypass authentication and issue arbitrary API requests without a certificate. Affected versions: Foreman prior to 1.5.4 and foreman-proxy in Foreman 1.6...
CVE-2014-3691
Smart Proxy aka Smart-Proxy and foreman-proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate...
PT-2015-3734 · Foreman · Foreman
Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.5.4 Foreman versions 1.6.x prior to 1.6.2 Description: The issue allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate, due to the failure ...
Important: Red Hat Security Advisory: foreman-proxy security update
Updated foreman-proxy packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform Foreman. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
foreman-proxy: failure to verify SSL certificates
It was discovered that foreman-proxy, when running in SSL-secured mode, did not correctly verify SSL client certificates. This could permit any client with access to the API to make requests and perform actions otherwise restricted...
Important: Red Hat Security Advisory: foreman-proxy security update
Updated foreman-proxy packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
foreman-proxy: failure to verify SSL certificates
It was discovered that foreman-proxy, when running in SSL-secured mode, did not correctly verify SSL client certificates. This could permit any client with access to the API to make requests and perform actions otherwise restricted...
foreman-proxy: failure to verify SSL certificates
It was discovered that foreman-proxy, when running in SSL-secured mode, did not correctly verify SSL client certificates. This could permit any client with access to the API to make requests and perform actions otherwise restricted...
FreeBSD : foreman-proxy SSL verification issue (c30c3a2e-4fb1-11e4-b275-14dae9d210b8)
Foreman Security reports : The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions permitting...
foreman: XSS in key name auto-completion
Cross-site scripting XSS vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name...
Foreman: app/controllers/bookmarks_controller.rb remote code execution
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute...
Foreman: host and host group parameter SQL injection
Multiple SQL injection vulnerabilities in app/models/concerns/hostcommon.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the 1 fqdn or 2 hostgroup parameter...
Foreman: Improper input validation
Foreman has improper input validation which could lead to partial Denial of Service...
rubygem-hammer_cli_foreman: /etc/hammer/cli.modules.d/foreman.yml is world-readable
rubygem-hammercliforeman: File /etc/hammer/cli.modules.d/foreman.yml world readable...
Foreman: Stored Cross Site Scripting
Cross-site scripting XSS vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark...
foreman-proxy: smart-proxy remote command injection
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetchbootfile...