Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

Foreman: foreman: unauthorized modification of host configurations via broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Foreman: satellite: graphql api permission bypass leads to information disclosure

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization

A flaw was found in foreman 1.5.1

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over…

Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after

Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to…

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw

A flaw was found in foreman from versions 1.18

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name

A vulnerability was found in foreman 1.14.0

Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1)…

Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or…

Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web…

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2)…

Foreman has improper input validation which could lead to partial Denial of Service

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface…

Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view…

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization…

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the…

A cross-site scripting (XSS) flaw was found in the foreman component of satellite

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

A sensitive information exposure vulnerability was found in foreman

A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer

Foreman: foreman: information disclosure via improper validation of nested request parameters

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature

foreman before 1.14.0 is vulnerable to an information leak

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read…