Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
theforeman foreman vulnerabilities and exploits
(subscribe to this query)
9
CVSSv2
CVE-2021-3584
A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity a...
Theforeman Foreman
Theforeman Foreman 3.0.0
Redhat Satellite 6.0
7.5
CVSSv2
CVE-2013-0210
The smart proxy Puppet run API in Foreman prior to 1.2.0 allows remote malicious users to execute arbitrary commands via vectors related to escaping and Puppet commands.
Theforeman Foreman
Theforeman Foreman 0.4.1
Theforeman Foreman 0.4
Theforeman Foreman 0.2
Theforeman Foreman 0.3
Theforeman Foreman 0.1
7.5
CVSSv2
CVE-2013-0171
Foreman prior to 1.1 allows remote malicious users to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
Theforeman Foreman
7.5
CVSSv2
CVE-2012-5648
Multiple SQL injection vulnerabilities in Foreman prior to 1.0.2 allow remote malicious users to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism.
Theforeman Foreman 0.1
Theforeman Foreman 0.2
Theforeman Foreman 0.4.1
Theforeman Foreman
Theforeman Foreman 0.3
Theforeman Foreman 0.4
6.8
CVSSv2
CVE-2017-2667
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Theforeman Hammer Cli
Redhat Satellite 6.3
Redhat Satellite Capsule 6.3
6.8
CVSSv2
CVE-2015-5246
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
Theforeman Foreman 1.9.0
6.8
CVSSv2
CVE-2014-0090
Session fixation vulnerability in Foreman prior to 1.4.2 allows remote malicious users to hijack web sessions via the session id cookie.
Theforeman Foreman 1.2.2
Theforeman Foreman 1.2.1
Theforeman Foreman 1.2.0
Theforeman Foreman 1.2.3
Theforeman Foreman
Theforeman Foreman 1.0
Theforeman Foreman 1.4.0
Theforeman Foreman 1.1
6.5
CVSSv2
CVE-2021-3589
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system avai...
Theforeman Foreman Ansible
Redhat Satellite 6.0
6.5
CVSSv2
CVE-2014-8183
It was found that foreman, versions 1.x.x prior to 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.
Theforeman Foreman
Redhat Satellite 6.0
6.5
CVSSv2
CVE-2017-7505
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such...
Theforeman Foreman 1.12.3
Theforeman Foreman 1.13.0
Theforeman Foreman 1.12.4
Theforeman Foreman 1.9.2
Theforeman Foreman 1.10.0
Theforeman Foreman 1.9.3
Theforeman Foreman 1.12.0
Theforeman Foreman 1.11.3
Theforeman Foreman 1.9.0
Theforeman Foreman 1.8.3
Theforeman Foreman 1.9.1
Theforeman Foreman 1.8.4
Theforeman Foreman 1.5.0
Theforeman Foreman 1.5.1
Theforeman Foreman 1.12.1
Theforeman Foreman 1.12.2
Theforeman Foreman 1.13.2
Theforeman Foreman 1.13.3
Theforeman Foreman 1.14.3
Theforeman Foreman 1.15.0
Theforeman Foreman 1.10.1
Theforeman Foreman 1.11.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4654
CVE-2023-49606
encryption
NULL pointer dereference
CVE-2024-4439
CVE-2024-4649
race condition
CVE-2024-27202
CVE-2024-34566
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
6
NEXT »