Total 81 security vulnerabilities recorded for theforeman software and firmware.
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, w...
A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Hos...
A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keys...
An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system...
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on t...
A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts...
A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output....
A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allow...
An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that shoul...
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that s...
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts...
A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to o...
A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with vie...
Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the f...
An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that...
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. Th...
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azu...
rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable...
Foreman has improper input validation which could lead to partial Denial of Service...
Katello has a Denial of Service vulnerability in API OAuth authentication...
Katello: Username in Notification page has cross site scripting...
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container ima...
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker wit...