Skip to contentTheforeman Foreman vulnerabilities
- theforeman foremanMultiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote...CVE-2014-35315.4 Medium
- theforeman foremanCross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman...CVE-2014-02085.4 Medium
- theforeman foremanThe LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of...CVE-2015-52468.1 High
- theforeman foremanCross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.CVE-2015-52826.1 Medium
- theforeman foremanForeman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the...CVE-2015-51528.1 High
- foremanForeman since version 1.5 is vulnerable to an incorrect authorization check due to which users...CVE-2017-75058.8 High
- theforeman foremanCross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in...CVE-2016-6320Fix available5.4 Medium
- theforeman foremanCross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2,...CVE-2016-63196.1 Medium
- theforeman foremanForeman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the...CVE-2016-53905.3 Medium
- theforeman foremanForeman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview...CVE-2016-49955.3 Medium
- theforeman foremanThe (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1...CVE-2016-4475Fix available8.8 High
- theforeman foremanThe (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1...CVE-2016-44515.0 Medium
- theforeman foremanEval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman...CVE-2016-37288.8 High
- theforeman foremanForeman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read,...CVE-2016-21005.4 Medium
- theforeman foreman, redhat satellite +1 moreForeman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which...CVE-2015-5233Fix available4.2 Medium
- theforeman foremanMultiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10...CVE-2015-7518Fix available4.3 Medium
- theforeman foremanForeman before 1.9.0 allows remote authenticated users with the edit_users permission to edit...CVE-2015-32356.0 Medium
- theforeman foremanForeman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session,...CVE-2015-31555.0 Medium
- theforeman foremanForeman before 1.7.5 allows remote authenticated users to bypass organization and location...CVE-2015-18444.0 Medium
- theforeman foremanForman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in...CVE-2015-18165.0 Medium
- theforeman foremanCross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1...CVE-2014-36534.3 Medium
- theforeman foreman, redhat openstack +1 moreSmart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2...CVE-2014-3691Fix available7.5 High
- theforeman foremanMultiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5...CVE-2014-34924.3 Medium
- theforeman foremanCross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows...CVE-2014-34914.3 Medium
- theforeman foremanDirectory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1...CVE-2014-45076.4 Medium
- theforeman foremanThe Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute...CVE-2014-0007Public exploitFix available7.5 High
- theforeman foremanForeman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews,...CVE-2014-01925.0 Medium
- theforeman foremanSession fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web...CVE-2014-00906.8 Medium
- theforeman foremanThe smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute...CVE-2013-02107.5 High
- theforeman foremanForeman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest...CVE-2013-01876.5 Medium
- theforeman foremanThe external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain...CVE-2013-01745.0 Medium
- theforeman foremanForeman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for...CVE-2013-01735.0 Medium
- theforeman foremanForeman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to...CVE-2013-01717.5 High
- theforeman foremanThe smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify...CVE-2012-54773.6 Low
- theforeman foremanMultiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute...CVE-2012-56487.5 High
- theforeman foremanCross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before...CVE-2014-00894.3 Medium
- theforeman foreman, redhat openstack +1 moreMultiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1...CVE-2013-4386Fix available7.5 High
- theforeman foreman, redhat openstack +1 moreapp/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict...CVE-2013-41827.5 High
- theforeman foreman, redhat openstack +1 moreThe (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow...CVE-2013-41805.0 Medium
- theforeman foreman, redhat openstack +1 moreEval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1...CVE-2013-2121Public exploitEPSS 24.8%6.0 Medium
- theforeman foreman, redhat openstack +1 moreThe create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows...CVE-2013-2113Public exploitEPSS 20.9%6.0 Medium