1318 matches found
Information Disclosure
foreman is vulnerable to information disclosure. The form helper does not authorize options for associated objects, allowing users to see the names of such objects...
Authorization Bypass
foreman is vulnerable to authorization bypass. The access to provisioning template previews is not properly restricted, allowing remote attackers to obtain confidential information via the hostname parameter...
Denial Of Service (DoS)
foreman is vulnerable to denial of service. An improper input validation allows an attacker to crash the application...
Cross-Site Scripting (XSS)
foreman is vulnerable to cross-site scripting. A remotely authenticated user is able to inject and execute arbitrary Javascript in another user's browser via the bookmark name...
Exposed API
foreman does not properly restrict access to APIs. A remote attacker is able to access arbitrary hosts via an API request...
Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container
Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...
Information Disclosure
foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...
CVE-2014-3590
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
Cross site request forgery (csrf)
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
CVE-2014-3590
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
CVE-2014-3590
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
CVE-2014-3590
CVE-2014-3590 affects Foreman as shipped with Red Hat Satellite 6. The logout action does not validate the CSRF token, enabling an attacker to force a user logout by viewing specially crafted content. Connected Red Hat advisory RHSA-2015:1592 documents Foreman-related issues and notes related fix...
PT-2020-7652
Name of the Vulnerable Software and Affected Versions Foreman as shipped with Red Hat Satellite 6 affected versions not specified Description The issue concerns a failure to check for a correct CSRF token in the logout action, allowing an attacker to log out a user by having them view specially...
CVE-2014-3590: Cross-Site Request Forgery (CSRF)
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...
PT-2019-7043
Name of the Vulnerable Software and Affected Versions rubygem-hammer cli foreman affected versions not specified Description The issue is related to a file permission problem, where the file /etc/hammer/cli.modules.d/foreman.yml is world readable. This could potentially allow unauthorized access ...
CVE-2014-0091
Foreman has improper input validation which could lead to partial Denial of Service...
Input validation
Foreman has improper input validation which could lead to partial Denial of Service...
CVE-2014-0091
Foreman has improper input validation which could lead to partial Denial of Service...
CVE-2014-0091
The connected documents confirm CVE-2014-0091 affects Foreman, with the underlying issue described as improper input validation that can cause a partial Denial of Service. The sources (NVD, Veracode) consistently report DoS due to input validation problems in Foreman. No concrete vendor/version d...