Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Foreman: satellite: graphql api permission bypass leads to information disclosure

A path traversal vulnerability exists in Ansible when extracting tarballs

A credential leak vulnerability was found in Red Hat Satellite

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal…

An issue was discovered in libjpeg 9a and 9d

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS)

A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization

A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT)

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over…

Red Hat Satellite 6 allows local users to access mongod and delete pulp_database

Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to…

Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via a group name, related to…

Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via the (1) RHNMD User or (2)…

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the…

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval…

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE)

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE)

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40…

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it…

A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before…

rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files

In previous versions of Puppet Agent it was possible to install a module with world writable permissions

A stored Cross-site scripting vulnerability was found in foreman

Katello has multiple XSS issues in various entities

A cross-site scripting (XSS) flaw was found in the katello component of Satellite

It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0