Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Foreman
(Theforeman)Repositories |
• https://github.com/theforeman/foreman
• https://github.com/theforeman/smart-proxy |
#Vulnerabilities | 68 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2019-08-01 | CVE-2014-8183 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations. | Satellite, Foreman | 7.4 | ||
2013-07-31 | CVE-2013-2113 | The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role. | Openstack, Foreman | N/A | ||
2013-07-31 | CVE-2013-2121 | Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute. | Openstack, Foreman | N/A | ||
2013-09-16 | CVE-2013-4180 | The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol. | Openstack, Foreman | N/A | ||
2013-09-16 | CVE-2013-4182 | app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request. | Openstack, Foreman | N/A | ||
2013-11-20 | CVE-2013-4386 | Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter. | Openstack, Foreman | N/A | ||
2014-03-27 | CVE-2014-0089 | Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark. | Foreman | N/A | ||
2014-05-08 | CVE-2014-0090 | Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie. | Foreman | N/A | ||
2014-05-08 | CVE-2014-0192 | Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof." | Foreman | N/A | ||
2014-06-20 | CVE-2014-0007 | The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file. | Foreman | N/A |