Filtered by vendor Theforeman Subscriptions
Filtered by product Foreman Subscriptions
Total 69 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-3531 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
CVE-2014-3491 1 Theforeman 1 Foreman 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.
CVE-2014-3492 1 Theforeman 1 Foreman 2024-08-06 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.
CVE-2014-0192 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
CVE-2014-0208 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
CVE-2014-0090 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.
CVE-2014-0091 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 5.3 Medium
Foreman has improper input validation which could lead to partial Denial of Service
CVE-2014-0089 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
CVE-2014-0007 2 Redhat, Theforeman 4 Openstack, Satellite, Satellite Capsule and 1 more 2024-08-06 N/A
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
CVE-2015-7518 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.
CVE-2015-5282 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
CVE-2015-5246 1 Theforeman 1 Foreman 2024-08-06 N/A
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
CVE-2015-5233 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
CVE-2015-5152 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
CVE-2015-3235 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
CVE-2015-3155 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVE-2015-1844 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
CVE-2015-1816 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
CVE-2016-9593 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.
CVE-2016-8634 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-08-06 N/A
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.