Theforeman Foreman vulnerabilities

CVE-2016-4995 [MEDIUM] CWE-200 CVE-2016-4995: Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisio Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.

CVE-2021-3469 [MEDIUM] CWE-863 CVE-2021-3469: Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling fla Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorizatio

CVE-2016-6319 [MEDIUM] CWE-79 CVE-2016-6319: Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.

CVE-2026-5138 [MEDIUM] CWE-639 CVE-2026-5138: A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross- A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the

CVE-2017-15100 [MEDIUM] CWE-79 CVE-2017-15100: An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.

CVE-2018-14664 [MEDIUM] CWE-79 CVE-2018-14664: A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists d A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

CVE-2015-5233 [MEDIUM] CWE-264 CVE-2015-5233: Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allo Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual

CVE-2015-3155 [MEDIUM] CWE-284 CVE-2015-3155: Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, wh Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVE-2016-8634 [MEDIUM] CWE-79 CVE-2016-8634: A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, i A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a us

CVE-2016-6320 [MEDIUM] CWE-79 CVE-2016-6320: Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Forema Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.

CVE-2015-5282 [MEDIUM] CWE-79 CVE-2015-5282: Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.

CVE-2014-3531 [MEDIUM] CWE-79 CVE-2014-3531: Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticat Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.

CVE-2014-0192 [MEDIUM] CWE-264 CVE-2014-0192: Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, whic Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."

CVE-2013-0173 [MEDIUM] CWE-310 CVE-2013-0173: Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attack Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.

CVE-2015-1844 [MEDIUM] CWE-264 CVE-2015-1844: Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restricti Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.

CVE-2013-4180 [MEDIUM] CWE-20 CVE-2013-4180: The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote a The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.

CVE-2014-0208 [MEDIUM] CWE-79 CVE-2014-0208: Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman befo Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.

CVE-2020-10710 [MEDIUM] CWE-522 CVE-2020-10710: A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellit A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.

CVE-2018-16861 [MEDIUM] CWE-79 CVE-2018-16861: A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users

CVE-2016-7077 [MEDIUM] CWE-285 CVE-2016-7077: foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper do foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.