Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
theforeman vulnerabilities and exploits
(subscribe to this query)
5.4
CVSSv3
CVE-2014-3531
Multiple cross-site scripting (XSS) vulnerabilities in Foreman prior to 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
Theforeman Foreman
NA
CVE-2013-0171
Foreman prior to 1.1 allows remote malicious users to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
Theforeman Foreman
NA
CVE-2013-0174
The external node classifier (ENC) API in Foreman prior to 1.1 allows remote malicious users to obtain the hashed root password via an API request.
Theforeman Foreman
5.4
CVSSv3
CVE-2013-0283
Katello: Username in Notification page has cross site scripting
Theforeman Katello -
5.4
CVSSv3
CVE-2021-3469
Foreman versions prior to 2.3.4 and prior to 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternativ...
Theforeman Foreman
5.3
CVSSv3
CVE-2014-0091
Foreman has improper input validation which could lead to partial Denial of Service
Theforeman Foreman -
5.4
CVSSv3
CVE-2014-0208
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman prior to 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
Theforeman Foreman
4.3
CVSSv3
CVE-2016-7077
foreman prior to 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.
Theforeman Foreman
NA
CVE-2015-1816
Forman prior to 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle malicious users to spoof LDAP servers via a crafted certificate.
Theforeman Foreman
6.1
CVSSv3
CVE-2017-7535
foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.
Theforeman Foreman
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4040
privilege escalation
CVE-2024-4112
CVE-2024-32872
man-in-the-middle
CVE-2024-32788
bypass
CVE-2024-3400
CVE-2024-28976
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »