An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman

Foreman: excessive permissions for viewer role on preview

A command injection flaw was found in foreman

An arbitrary code execution flaw was found in Foreman

An arbitrary code execution flaw was found in Foreman

Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Forman: foreman: remote code execution via command injection in websocket proxy

A flaw was found in Foreman project

A flaw was found in foreman before version 1.15 in the logging of adding and registering images

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging

A flaw was found in foreman before 1.16.1

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all…

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location…

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary…

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in…

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user…

Foreman: command injection in foreman-tail

Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse

A flaw was found in the Foreman project

Foreman: ssti and insecure deserialization in foreman-rake configuration

Foreman: unauthenticated information disclosure via provisioning token validation flaw

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources

A server side remote code execution vulnerability was found in Foreman project

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Foreman: satellite: graphql api permission bypass leads to information disclosure

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization

A flaw was found in foreman 1.5.1

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over…

Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after

Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to…

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw

A flaw was found in foreman from versions 1.18

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name

A vulnerability was found in foreman 1.14.0

Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1)…

Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or…

Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web…

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2)…

Foreman has improper input validation which could lead to partial Denial of Service

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface…

Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view…