Vendor
The Foreman Project
11 known vulnerabilities.
8 results · Clear filters · Feed
-
Medium 5.0
Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an …
-
Medium 6.5
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were sea…
-
Medium 4.9
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to t…
-
Medium 4.3
katello SQL Injection vulnerability
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2…
-
Medium 4.3
katello Improper Privilege Management vulnerability
A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the reposito…
-
Medium 6.1
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could …
-
Medium 6.1
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains…
-
Medium 6.4
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI.…