CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2013-4182 – foreman: app/controllers/api/v1/hosts_controller.rb API privilege escalation
https://notcve.org/view.php?id=CVE-2013-4182
04 Sep 2013 — app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request. app/controllers/api/v1/hosts_controller.rb en Foreman anteriores a v1.2.2 no restringe correctamente el acceso a hosts arbitrarios a través de una petición API. The Foreman packages provide facilities for rapidly deploying Red Hat OpenStack 3.0. These packages are provided as a Technology Preview. For more information on th... • http://projects.theforeman.org/issues/2863 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 32%CPEs: 3EXPL: 2CVE-2013-2113 – Foreman (RedHat OpenStack/Satellite) - users/create Mass Assignment
https://notcve.org/view.php?id=CVE-2013-2113
27 Jun 2013 — The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role. El método "create" en app/controllers/users_controller.rb en Foreman anterior a 1.2.0-RC2, permite a usuarios autenticados remotamente con permisos para crear o editar otros usuarios elevar sus privilegios mediante (1) modificando el flag de admin o (2) asigna... • https://packetstorm.news/files/id/122897 • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 9.8EPSS: 45%CPEs: 3EXPL: 4CVE-2013-2121 – Foreman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection
https://notcve.org/view.php?id=CVE-2013-2121
27 Jun 2013 — Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute. Vulnerabilidad de inyección Eval en el método "create" en el controlador Bookmarks en Foreman anterior a 1.2.0-RC2, permite a usuarios autenticados remotamente con permisos para crear favoritos, la ejecución arbitraria de código a través de un atributo de nombre de controlado... • https://packetstorm.news/files/id/122510 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •