Theforeman Foreman vulnerabilities

CVE-2014-0089 [MEDIUM] CWE-79 CVE-2014-0089: Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1. Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.

CVE-2014-3491 [MEDIUM] CWE-79 CVE-2014-3491: Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remot Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.

CVE-2023-4886 [MEDIUM] CWE-200 CVE-2023-4886: A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

CVE-2014-3492 [MEDIUM] CWE-79 CVE-2014-3492: Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 an Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.

CVE-2012-5477 [LOW] CWE-264 CVE-2012-5477: The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify file The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors.