CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2013-0210
https://notcve.org/view.php?id=CVE-2013-0210
08 May 2014 — The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands. La API de ejecución de Smart Proxy Puppet en Foreman anterior a 1.2.0 permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores relacionados con escaparse y comandos Puppet. • http://theforeman.org/security.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5477
https://notcve.org/view.php?id=CVE-2012-5477
08 May 2014 — The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors. Smart Proxy en Foreman anterior a 1.1 utiliza un umask configurado a 0, lo que permite a usuarios locales modificar archivos creados por el demonio a través de vectores no especificados. • http://projects.theforeman.org/issues/1929 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2014-0192
https://notcve.org/view.php?id=CVE-2014-0192
08 May 2014 — Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof." Foreman 1.4.0 anterior a 1.5.0 no restringe debidamente acceso a la provisión de vistas preliminares de plantillas, lo que permite a atacantes remotos obtener información sensible a través del parámetro hostname, relacionado con 'falsificar.' • http://projects.theforeman.org/issues/5436 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2014-0090
https://notcve.org/view.php?id=CVE-2014-0090
08 May 2014 — Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie. Vulnerabilidad de fijación de sesión en Foreman anterior a 1.4.2 permite a atacantes remotos secuestrar sesiones web a través de la cookie session id. • http://projects.theforeman.org/issues/4457 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2012-5648
https://notcve.org/view.php?id=CVE-2012-5648
04 Apr 2014 — Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism. Múltiples vulnerabilidades de inyección SQL en Foreman anterior a 1.0.2 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través de parámetros no especificados hacia (1) app/models/hostext/search.rb o (2) app/models/puppetclass.rb, relacionado con... • http://osvdb.org/show/osvdb/88618 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2014-0089
https://notcve.org/view.php?id=CVE-2014-0089
27 Mar 2014 — Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark. Vulnerabilidad de XSS en app/views/common/500.html.erb en Foreman 1.4.x anterior a 1.4.2 permite a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a través del nombre de favoritos cuando se añade un favorito. • http://projects.theforeman.org/issues/4456 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2013-4386 – Foreman: host and host group parameter SQL injection
https://notcve.org/view.php?id=CVE-2013-4386
14 Nov 2013 — Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter. Múltiples vulnerabilidades de inyección SQL en app/models/concerns/host_common.rb de Foreman anterior a la versión 1.2.3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de (1) fqdn o (2) parámetro hostgroup. The Foreman packages provide facilities for rapidly deploying Red Hat OpenStac... • http://projects.theforeman.org/issues/3160 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-4180 – Foreman: hosts_controller.rb power/ipmi_boot Symbol creation DoS
https://notcve.org/view.php?id=CVE-2013-4180
04 Sep 2013 — The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol. Las acciones (1) power y (2) ipmi_boot en el HostController de Foreman anterior 1.2.2 permite a atacante remoto causar denegacion de servicio (consumo de memoria) a través de una entrda sin especificar que es convertida a un simbolo The Foreman packages provide facilities for rapidly deploying Red H... • http://projects.theforeman.org/issues/2860 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2013-4182 – foreman: app/controllers/api/v1/hosts_controller.rb API privilege escalation
https://notcve.org/view.php?id=CVE-2013-4182
04 Sep 2013 — app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request. app/controllers/api/v1/hosts_controller.rb en Foreman anteriores a v1.2.2 no restringe correctamente el acceso a hosts arbitrarios a través de una petición API. The Foreman packages provide facilities for rapidly deploying Red Hat OpenStack 3.0. These packages are provided as a Technology Preview. For more information on th... • http://projects.theforeman.org/issues/2863 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 32%CPEs: 3EXPL: 2CVE-2013-2113 – Foreman (RedHat OpenStack/Satellite) - users/create Mass Assignment
https://notcve.org/view.php?id=CVE-2013-2113
27 Jun 2013 — The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role. El método "create" en app/controllers/users_controller.rb en Foreman anterior a 1.2.0-RC2, permite a usuarios autenticados remotamente con permisos para crear o editar otros usuarios elevar sus privilegios mediante (1) modificando el flag de admin o (2) asigna... • https://packetstorm.news/files/id/122897 • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •