CVSS: 6.1EPSS: 0%CPEs: 45EXPL: 0CVE-2015-5282
https://notcve.org/view.php?id=CVE-2015-5282
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Foreman 1.7.0 y posteriores. • http://projects.theforeman.org/issues/11859 http://www.openwall.com/lists/oss-security/2015/09/21/3 https://bugzilla.redhat.com/show_bug.cgi?id=1264221 https://github.com/theforeman/foreman/commit/4f3555b217be8723e8045f9816d147b5f684ec57 https://theforeman.org/security.html#2015-5282 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 75EXPL: 0CVE-2017-7505
https://notcve.org/view.php?id=CVE-2017-7505
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords. Foreman desde la versión 1.5, es vulnerable a una comprobación de autorización incorrecta debido a que los usuarios con permiso de administración de usuario que están asignados a alguna organización(es) pueden realizar todas las operaciones otorgadas por estos permisos sobre todos los objetos del usuario administrador fuera de su alcance, tal como la edición de cuentas de administrador global incluyendo el cambio de sus contraseñas. • http://projects.theforeman.org/issues/19612 http://www.securityfocus.com/bid/98607 https://github.com/theforeman/foreman/pull/4545 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6320
https://notcve.org/view.php?id=CVE-2016-6320
Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form. Vulnerabilidad de XSS en app/assets/javascripts/host_edit_interfaces.js en Foreman en versiones anteriores a 1.12.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del identificador de dispositivo de interfaz de red en el formulario de interfaz del anfitrión. • http://projects.theforeman.org/issues/16022 http://www.securityfocus.com/bid/92431 https://access.redhat.com/errata/RHBA-2016:1885 https://bugzilla.redhat.com/show_bug.cgi?id=1365785 https://github.com/theforeman/foreman/pull/3714/commits/850c38451c7bbde75521b796d16aca26e4d240a0 https://theforeman.org/security.html#2016-6320 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2016-6319 – foreman: Persistent XSS in Foreman remote execution plugin
https://notcve.org/view.php?id=CVE-2016-6319
Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter. Vulnerabilidad de XSS en app/helpers/form_helper.rb en Foreman en versiones anteriores a 1.12.2, como se utiliza en Remote Execution y posiblemente otros plugins, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro de etiqueta. It was found that foreman is vulnerable to a stored XSS via a job template with a malformed name. This could allow an attacker with privileges to set the name in a template to display arbitrary HTML including scripting code within the web interface. • http://projects.theforeman.org/issues/16019 http://projects.theforeman.org/issues/16024 http://www.securityfocus.com/bid/92429 https://access.redhat.com/errata/RHSA-2018:0336 https://bugzilla.redhat.com/show_bug.cgi?id=1365815 https://github.com/theforeman/foreman/commit/0f35fe14acf0d0d3b55e9337bc5e2b9640ff2372 https://theforeman.org/security.html#2016-6319 https://access.redhat.com/security/cve/CVE-2016-6319 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •