Foreman Project Foreman vulnerabilities

3 vulnerabilities

Known vulnerabilities in Foreman Project Foreman, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2018-1097foreman projectforeman+2
EPSS score
1.74%
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.6.5CVE-2018-1096foreman projectforeman+2
EPSS score
1.33%
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.6.1CVE-2017-15100foreman projectforeman+3
EPSS score
1.10%
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.