A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending…

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private…

Foreman: satellite: graphql api permission bypass leads to information disclosure

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over…

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this…

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name

A flaw was found in Hibernate Validator version 6.1.2.Final

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore