Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2014-3653

foreman: cross-site scripting (XSS) flaw in template preview screen

Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2014-3691

foreman-proxy: failure to verify SSL certificates

Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat Theforeman
Products
Openstack Openstack-installer Satellite and 2 more
CVE-2015-0223

qpid-cpp: anonymous access to qpidd cannot be prevented

Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.

CVSS 2.0 · 5.0 Medium EPSS 6.6% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg Satellite and 1 more
CVE-2015-1609

mongodb: DoS due to improper BSON validation

MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Mongodb Redhat
Products
Fedora Mongodb Satellite and 1 more
CVE-2015-1816

foreman: lack of SSL certificate validation when performing LDAPS authentication

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.

CVSS 2.0 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-6320

satellite6: stored XSS while provisioning new host

Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2015-3155

foreman: the _session_id cookie is issued without the Secure flag

Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-6319

foreman: Persistent XSS in Foreman remote execution plugin

Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.

CVSS 3.0 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-4995

foreman: Information disclosure in provisioning template previews

Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.

CVSS 3.0 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-4475

foreman: API and UI actions/URLs not limited to the orgs/locations assigned

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2015-3225

rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

CVSS 2.0 · 5.0 Medium EPSS 7.9% KEV · Not listed
Vendors
Debian Opensuse Rack Project and 1 more
Products
Debian Linux Opensuse Rack and 3 more
CVE-2015-3235

foreman: edit_users permission allows changing of admin passwords

Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.

CVSS 2.0 · 6.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-4451

foreman: privilege escalation through Organization and Locations API

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

CVSS 3.0 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2013-6459

rubygem-will_paginate: XSS vulnerabilities

Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Mislav Marohnic Redhat
Products
Will Paginate Satellite Satellite Capsule
CVE-2013-6639

v8: DoS (out-of-bounds write) in DehoistArrayIndex function in hydrogen.cc

The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Software Collections and 2 more
CVE-2013-6640

v8: DoS (out-of-bounds read) in DehoistArrayIndex function in hydrogen.cc

The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Software Collections and 2 more
CVE-2013-6650

v8: incorrect handling of popular pages

The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 3 more
CVE-2013-2882

v8: remote DoS or unspecified other impact via type confusion

Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Google Nodejs and 1 more
Products
Debian Linux Chrome Node.js and 3 more