Show filters
90 Total Results
Displaying 41-50 of 90
Sort by:
Attacker Value
Unknown
CVE-2017-2672
Disclosure Date: June 21, 2018 (last updated November 26, 2024)
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.
0
Attacker Value
Unknown
CVE-2016-9593
Disclosure Date: April 16, 2018 (last updated November 08, 2023)
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.
0
Attacker Value
Unknown
CVE-2018-1096
Disclosure Date: April 05, 2018 (last updated November 26, 2024)
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
0
Attacker Value
Unknown
CVE-2018-1097
Disclosure Date: April 04, 2018 (last updated November 26, 2024)
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.
0
Attacker Value
Unknown
CVE-2017-2667
Disclosure Date: March 12, 2018 (last updated January 27, 2024)
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
0
Attacker Value
Unknown
CVE-2017-15100
Disclosure Date: November 27, 2017 (last updated February 16, 2024)
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.
0
Attacker Value
Unknown
CVE-2014-3531
Disclosure Date: October 18, 2017 (last updated November 26, 2024)
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
0
Attacker Value
Unknown
CVE-2014-0208
Disclosure Date: October 16, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
0
Attacker Value
Unknown
CVE-2015-5246
Disclosure Date: October 06, 2017 (last updated November 26, 2024)
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
0
Attacker Value
Unknown
CVE-2015-5282
Disclosure Date: September 25, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
0
