Lucene search

K

Theforeman Security Vulnerabilities

cve
cve

CVE-2023-4886

A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world...

6.7CVSS

4.5AI Score

0.0004EPSS

2023-10-03 03:15 PM
100
cve
cve

CVE-2023-0118

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating...

9.1CVSS

9.3AI Score

0.001EPSS

2023-09-20 02:15 PM
66
cve
cve

CVE-2012-3503

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary...

9.8CVSS

9.3AI Score

0.015EPSS

2012-08-25 10:29 AM
23
cve
cve

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts...

6.1CVSS

6AI Score

0.001EPSS

2017-11-27 02:29 PM
38
cve
cve

CVE-2017-2667

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle...

8.1CVSS

7.8AI Score

0.003EPSS

2018-03-12 03:29 PM
55
cve
cve

CVE-2015-1816

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted...

6.2AI Score

0.001EPSS

2015-08-14 06:59 PM
30
cve
cve

CVE-2015-1844

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST...

6.2AI Score

0.002EPSS

2015-08-14 06:59 PM
33
cve
cve

CVE-2016-7078

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned no organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their....

4.3CVSS

4.3AI Score

0.003EPSS

2018-09-10 03:29 PM
30
cve
cve

CVE-2016-7077

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than...

4.3CVSS

4.6AI Score

0.003EPSS

2018-09-10 03:29 PM
27
cve
cve

CVE-2016-9593

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those...

8.8CVSS

8.3AI Score

0.002EPSS

2018-04-16 03:29 PM
26
cve
cve

CVE-2016-9595

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary...

7.3CVSS

5.2AI Score

0.0004EPSS

2018-07-27 06:29 PM
29
cve
cve

CVE-2023-0462

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML...

9.1CVSS

9.3AI Score

0.001EPSS

2023-09-20 02:15 PM
27
cve
cve

CVE-2022-3874

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...

9.1CVSS

9.3AI Score

0.001EPSS

2023-09-22 02:15 PM
40
cve
cve

CVE-2016-8639

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web...

6.1CVSS

5.1AI Score

0.002EPSS

2018-08-01 01:29 PM
33
cve
cve

CVE-2014-8183

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other...

7.4CVSS

7.3AI Score

0.001EPSS

2019-08-01 02:15 PM
37
cve
cve

CVE-2016-6319

Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label...

6.1CVSS

6.2AI Score

0.014EPSS

2016-08-19 09:59 PM
33
cve
cve

CVE-2016-2100

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks...

5.4CVSS

5.2AI Score

0.002EPSS

2016-05-20 02:59 PM
26
cve
cve

CVE-2016-6320

Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface...

5.4CVSS

5.1AI Score

0.001EPSS

2016-08-19 09:59 PM
31
cve
cve

CVE-2015-5152

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle...

8.1CVSS

7.8AI Score

0.002EPSS

2017-07-17 01:18 PM
26
cve
cve

CVE-2015-3235

Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified...

6.1AI Score

0.003EPSS

2015-08-14 06:59 PM
30
cve
cve

CVE-2014-0208

Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key...

5.4CVSS

5AI Score

0.001EPSS

2017-10-16 06:29 PM
29
cve
cve

CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to...

7.8AI Score

0.037EPSS

2014-06-20 02:55 PM
24
cve
cve

CVE-2014-0192

Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to...

6.4AI Score

0.003EPSS

2014-05-08 02:29 PM
16
cve
cve

CVE-2016-4995

Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a...

5.3CVSS

4.7AI Score

0.001EPSS

2016-08-19 09:59 PM
30
4
cve
cve

CVE-2016-3728

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to...

8.8CVSS

9AI Score

0.035EPSS

2016-05-20 02:59 PM
30
cve
cve

CVE-2014-3531

Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2)...

5.4CVSS

5.1AI Score

0.001EPSS

2017-10-18 02:29 PM
28
cve
cve

CVE-2015-3155

Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

6.4AI Score

0.006EPSS

2015-08-14 06:59 PM
28
cve
cve

CVE-2014-0090

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id...

6.9AI Score

0.007EPSS

2014-05-08 02:29 PM
28
cve
cve

CVE-2014-0089

Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a...

5.4AI Score

0.002EPSS

2014-03-27 04:55 PM
32
cve
cve

CVE-2016-4475

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified...

8.8CVSS

8.2AI Score

0.004EPSS

2016-08-19 09:59 PM
29
4
cve
cve

CVE-2016-4451

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that....

5CVSS

4.9AI Score

0.002EPSS

2016-08-19 09:59 PM
28
4
cve
cve

CVE-2015-7518

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit...

5.7AI Score

0.002EPSS

2015-12-17 07:59 PM
23
cve
cve

CVE-2013-2113

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary...

6.7AI Score

0.111EPSS

2013-07-31 01:20 PM
24
cve
cve

CVE-2013-4182

app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API...

6.9AI Score

0.007EPSS

2013-09-16 07:14 PM
24
cve
cve

CVE-2013-4180

The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a...

6.9AI Score

0.009EPSS

2013-09-16 07:14 PM
23
cve
cve

CVE-2013-2121

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name...

7.5AI Score

0.509EPSS

2013-07-31 01:20 PM
24
cve
cve

CVE-2015-5233

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from...

4.2CVSS

4.2AI Score

0.001EPSS

2016-04-11 09:59 PM
29
cve
cve

CVE-2014-3691

Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a...

7.6AI Score

0.006EPSS

2015-03-09 02:59 PM
23
cve
cve

CVE-2013-4386

Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup...

8.8AI Score

0.002EPSS

2013-11-20 02:12 PM
28
cve
cve

CVE-2018-14643

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged...

9.8CVSS

9.6AI Score

0.004EPSS

2018-09-21 01:29 PM
60
cve
cve

CVE-2014-0091

Foreman has improper input validation which could lead to partial Denial of...

5.3CVSS

5AI Score

0.002EPSS

2019-12-11 03:15 PM
34
cve
cve

CVE-2013-2101

Katello has multiple XSS issues in various...

5.4CVSS

5.2AI Score

0.001EPSS

2019-12-03 02:15 PM
21
cve
cve

CVE-2018-1097

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute...

8.8CVSS

8.5AI Score

0.002EPSS

2018-04-04 09:29 PM
38
cve
cve

CVE-2019-14825

A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged...

2.7CVSS

4AI Score

0.001EPSS

2019-11-25 04:15 PM
56
2
cve
cve

CVE-2017-2662

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository...

4.3CVSS

4.6AI Score

0.001EPSS

2018-08-22 04:29 PM
43
cve
cve

CVE-2016-8613

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser....

6.4CVSS

6AI Score

0.003EPSS

2018-07-31 08:29 PM
41
cve
cve

CVE-2016-8634

A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an...

6.1CVSS

5AI Score

0.001EPSS

2018-08-01 12:29 PM
33
cve
cve

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

4.3CVSS

6.4AI Score

0.002EPSS

2018-12-14 12:29 AM
44
cve
cve

CVE-2021-3589

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

8CVSS

7.5AI Score

0.001EPSS

2022-03-23 08:15 PM
74
cve
cve

CVE-2020-10710

A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext...

4.4CVSS

4.6AI Score

0.0004EPSS

2022-08-16 09:15 PM
42
6
Total number of security vulnerabilities89