foreman vulnerabilities (Red Hat)
384 vulnerabilities.
foremanRed HatThe pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or...7.1 HighforemanRed HatThe Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world...5.5 MediumforemanRed HatVersions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the...8.2 HighforemanRed HatDjango open redirect and possible XSS attack via user-supplied numeric redirect URLs6.1 MediumforemanRed HatQOS.ch Logback vulnerable to Deserialization of Untrusted Data9.8 CriticalforemanRed HatDenial of service in JBoss resteasy7.5 HighforemanRed HatCross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in...5.4 MediumforemanRed HatCross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2,...6.1 MediumforemanRed HatForeman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview...5.3 MediumforemanRed HatThe (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1...8.8 HighforemanRed HatThe (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1...5.0 MediumforemanRed HatForced Browsing in Twisted5.3 MediumforemanRed HatEval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman...8.8 HighforemanRed Hatsafemode gem allows context-dependent attackers to obtain sensitive information via the inspect method8.1 HighforemanRed HatThe Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before...8.8 HighforemanRed HatForeman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which...4.2 MediumforemanRed HatBouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain...3.3 LowforemanRed HatMultiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10...4.3 MediumforemanRed HatCRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94...4.3 MediumforemanRed HatForeman before 1.9.0 allows remote authenticated users with the edit_users permission to edit...6.0 MediumforemanRed HatForeman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session,...5.0 MediumforemanRed HatForeman before 1.7.5 allows remote authenticated users to bypass organization and location...4.0 MediumforemanRed HatForman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in...5.0 MediumforemanRed HatCross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1...4.3 MediumforemanRed HatThe ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does...5.9 MediumforemanRed Hatrest-client Gem Vulnerable to Session Fixation9.8 CriticalforemanRed Hatrest-client allows local users to obtain sensitive information by reading the log2.1 LowforemanRed HatSmart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2...7.5 HighforemanRed Hatsimplejson before 2.6.1 vulnerable to array index error5.9 MediumforemanRed HatThe Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute...7.5 HighforemanRed HatSimpleGeo python-oauth2 does not check the nonce allowing replay attacks4.3 MediumforemanRed HatForeman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews,...5.0 MediumforemanRed HatKafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml1.9 LowforemanRed HatSession fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web...6.8 MediumforemanRed HatCross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before...4.3 MediumforemanRed HatMultiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome...10.0 HighforemanRed HatThe default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote...6.4 MediumforemanRed HatThe StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16,...7.5 HighforemanRed Hatwill_paginate Cross-site Scripting vulnerability4.3 MediumforemanRed HatThe DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22...7.5 HighforemanRed HatThe DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22...7.5 HighforemanRed HatMultiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1...7.5 HighforemanRed HatSimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces5.8 MediumforemanRed Hatapp/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict...7.5 HighforemanRed HatThe (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow...5.0 MediumforemanRed HatEval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1...6.0 MediumforemanRed HatGoogle V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a...7.5 HighforemanRed HatThe SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic...3.4 LowforemanRed HatApache Tomcat affected by vulnerability in TLS and SSL protocol5.8 Medium