Session fixation

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

Default credentials

Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack...

Code injection

Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the 1 fact or 2 report import API...

CVE-2013-0174

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

Code injection

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

Cross site request forgery (csrf)

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

Cross site request forgery (csrf)

Foreman before 1.1 allows remote authenticated users to gain privileges via a 1 XMLHttpRequest or 2 AJAX request...

CVE-2013-0173

Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

Design/Logic Flaw

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for defaultvalues.yaml, which allows local users to obtain passwords and other sensitive information by reading the file...

Command injection

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

Information disclosure

Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."...

CVE-2013-0187

Foreman before 1.1 allows remote authenticated users to gain privileges via a 1 XMLHttpRequest or 2 AJAX request...

CVE-2013-0171

Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the 1 fact or 2 report import API...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2014-0192

CVE-2014-0192 affects Foreman: versions 1.4.0 through 1.4.x are vulnerable. The issue is that provisioning template previews were not properly restricted, allowing remote attackers to access sensitive information via the hostname parameter (spoof-related). The primary concrete detail available fr...

CVE-2014-0135

CVE-2014-0135 affects Kafo before 0.3.17 and 0.4.x before 0.5.2 (as used by Foreman). The issue is that default_values.yaml is world-readable, allowing local users to read passwords and other sensitive information. Remediation is to upgrade Kafo to 0.3.17+ or 0.4.x to 0.5.2+ (where fixed). If not...

CVE-2013-0187

Foreman before 1.1 allows remote authenticated users to gain privileges via a 1 XMLHttpRequest or 2 AJAX request...

CVE-2013-0174

The CVE-2013-0174 entry concerns Foreman’s external node classifier (ENC) API, specifically in versions prior to 1.1. The vulnerability enables remote attackers to obtain the hashed root password via an API request, indicating exposure of credential material through the ENC API. The provided data...

CVE-2013-0173

Foreman before version 1.1 uses a fixed salt named “foreman” to hash root passwords, making brute-force guessing easier. The vulnerability affects the password-hashing path in Foreman pre-1.1; the root credential protection is weakened due to the non-unique, predictable salt. The available source...