Approved changes feed: RSS · Atom
cpe:2.3:a:the_foreman_project:foreman:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | The Foreman Project (4090d153-dab4-57de-b64c-f15feede4708) |
|---|---|
| Product | Foreman (d74182b2-ec25-5a85-8461-db978df6f45a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-3893 |
vulnerable | 2026-06-08 05:13:56.320041 |
Details available
MEDIUM (4.9)
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
Published: 2019-04-09T15:17:14.000Z
Updated: 2024-08-04T19:19:18.608Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-16861 |
vulnerable | 2026-06-08 05:11:05.599881 |
Details available
HIGH (7.6)
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
Published: 2018-12-07T19:00:00.000Z
Updated: 2024-08-05T10:32:54.072Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8639 |
vulnerable | 2026-06-08 05:08:14.526734 |
Details available
MEDIUM (6.1)
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
Published: 2018-08-01T13:00:00.000Z
Updated: 2024-08-06T02:27:41.125Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8634 |
vulnerable | 2026-06-08 05:08:14.511610 |
Details available
MEDIUM (6.1)
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
Published: 2018-08-01T12:00:00.000Z
Updated: 2024-08-06T02:27:41.211Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8613 |
vulnerable | 2026-06-08 05:08:14.485260 |
Details available
MEDIUM (6.4)
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
Published: 2018-07-31T20:00:00.000Z
Updated: 2024-08-06T02:27:40.956Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.