Page 4 of 33 results (0.001 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-3155 – foreman: the _session_id cookie is issued without the Secure flag

https://notcve.org/view.php?id=CVE-2015-3155

12 Aug 2015 — Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Vulnerabilidad en Foreman en versiones anteriores a 1.8.1, no configura el indicador de seguridad para la cookie the _session_id en una sesión https, lo que facilita a atacantes remotos capturar esta cookie interceptando su transmisión dentro de una sesión http. It was found that Foreman di... • http://projects.theforeman.org/issues/10275 • CWE-284: Improper Access Control •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2014-3653 – foreman: cross-site scripting (XSS) flaw in template preview screen

https://notcve.org/view.php?id=CVE-2014-3653

06 Jul 2015 — Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template. Vulnerabilidad de XSS en la función Template Preview en Foreman anterior a 1.6.1 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una plantilla de provisionamiento manipulada. A cross-site scripting (XSS) flaw was found in Foreman's template preview screen. A remote a... • http://projects.theforeman.org/issues/7483 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0

CVE-2014-3691 – foreman-proxy: failure to verify SSL certificates

https://notcve.org/view.php?id=CVE-2014-3691

03 Mar 2015 — Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate. Smart Proxy (también conocido como Smart-Proxy y foreman-proxy) en Foreman en versiones anteriores a 1.5.4 y 1.6.x en versiones anteriores a 1.6.2 no valida certificados SSL, lo que permite a atacantes remotos eludir autenticación intencionada y... • http://projects.theforeman.org/issues/7822 • CWE-295: Improper Certificate Validation CWE-310: Cryptographic Issues •