The Foreman Project vulnerabilities

CVEs per yearBy the year they were published

1. 20186
2. 20192

Newest CVEs

• CVE-2019-10198

  An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which…

  The Foreman Project · foreman-tasks

  Medium6.5
• CVE-2019-3893

  In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password…

  The Foreman Project · foreman

  Medium4.9
• CVE-2018-14623

  A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the…

  The Foreman Project · katello

  Medium4.3
• CVE-2018-16861

  A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor,…

  The Foreman Project · foreman

  High7.6
• CVE-2017-2662

  A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on…

  The Foreman Project · foreman katello plugin

  Medium4.3
• CVE-2016-8639

  It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set…

  The Foreman Project · foreman

  Medium6.1
• CVE-2016-8634

  A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard…

  The Foreman Project · foreman

  Medium6.1
• CVE-2016-8613

  A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains…

  The Foreman Project · foreman

  Medium6.4