Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

A flaw was found in Foreman project

A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files

A flaw was found in foreman before version 1.15 in the logging of adding and registering images

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging

A flaw was found in foreman before 1.16.1

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute…

A flaw was found in rhn-proxy

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

An improper access control flaw was found in Candlepin

A flaw was found in satellite

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting)

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…

An authorization flaw was found in Foreman Ansible

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional…

Foreman: command injection in foreman-tail

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database

Foreman: ssti and insecure deserialization in foreman-rake configuration

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security)

Foreman: unauthenticated information disclosure via provisioning token validation flaw

An arithmetic overflow flaw was found in Satellite when creating a new personal access token

An account takeover flaw was found in Red Hat Satellite 6.7.2 onward

Nokogiri before 1.5.4 is vulnerable to XXE attacks

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes

A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String…

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)