CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 1CVE-2014-0007 – Foreman Smart-Proxy - Remote Command Injection
https://notcve.org/view.php?id=CVE-2014-0007
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file. Smart-Proxy en Foreman anterior a 1.4.5 y 1.5.x anterior a 1.5.1 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro path en tftp/fetch_boot_file. • https://www.exploit-db.com/exploits/39222 http://projects.theforeman.org/issues/6086 http://rhn.redhat.com/errata/RHSA-2014-0770.html https://access.redhat.com/security/cve/CVE-2014-0007 https://bugzilla.redhat.com/show_bug.cgi?id=1105369 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 1CVE-2014-0192
https://notcve.org/view.php?id=CVE-2014-0192
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof." Foreman 1.4.0 anterior a 1.5.0 no restringe debidamente acceso a la provisión de vistas preliminares de plantillas, lo que permite a atacantes remotos obtener información sensible a través del parámetro hostname, relacionado con 'falsificar.' • http://projects.theforeman.org/issues/5436 http://theforeman.org/security.html https://bugzilla.redhat.com/show_bug.cgi?id=1092354 • CWE-264: Permissions, Privileges, and Access Controls •