foreman
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-6861 | < 3.3 | Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api | HIGH 7.5 | 0.7 % | ||
| CVE-2024-8553 | | Foreman: read-only access to entire db from templates | MEDIUM 6.3 | 0.4 % | ||
| CVE-2024-7700 | | Foreman: command injection in "host init config" template via "install packages" field on foreman | MEDIUM 6.5 | 0.8 % | ||
| CVE-2024-4871 | 3.9.1.8 | Foreman: host ssh key not being checked in remote execution | MEDIUM 6.8 | 0.6 % | ||
| CVE-2022-3874 | | Os command injection via ct_command and fcct_command | CRITICAL 9.1 | 2.2 % | ||
| CVE-2023-0462 | | Arbitrary code execution through yaml global parameters | CRITICAL 9.1 | 1.0 % | ||
| CVE-2023-0118 | | Foreman: arbitrary code execution through templates | CRITICAL 9.1 | 1.4 % | ||
| CVE-2023-0119 | fixed in 3.4.2, 3.5.1.16, 3.5.2, … | Foreman: stored cross-site scripting in host tab | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-20260 | Not-Known | A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with | HIGH 7.8 | 0.2 % | ||
| CVE-2021-3590 | Affects foreman-1.6.0 onwards | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the A | HIGH 8.8 | 0.7 % | ||
| CVE-2021-3584 | foreman 2.4.1, foreman 2.5.1, foreman 3.0.0 | A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration op | HIGH 7.2 | 4.0 % | ||
| CVE-2021-20259 | before foreman_fog_proxmox 0.13.1 | A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacke | HIGH 7.8 | 0.3 % | ||
| CVE-2021-3469 | foreman 2.3.4, foreman 2.4.0 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can imperso | MEDIUM 5.4 | 0.3 % | ||
| CVE-2021-3494 | foreman 2.5.0 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle | MEDIUM 5.9 | 0.4 % |