Max CVSS 10.0 Min CVSS 1.9 Total Count2
IDCVSSSummaryLast (major) updatePublished
CVE-2009-5066 2.1
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
14-02-2024 - 01:17 13-08-2012 - 20:55
CVE-2013-4347 5.8
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.
13-02-2023 - 04:46 20-05-2014 - 14:55
CVE-2013-4182 7.5
app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
13-02-2023 - 04:45 16-09-2013 - 19:14
CVE-2013-4180 5.0
The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
13-02-2023 - 04:45 16-09-2013 - 19:14
CVE-2013-4201 4.0
Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions.
13-02-2023 - 04:45 01-05-2018 - 19:29
CVE-2013-2101 3.5
Katello has multiple XSS issues in various entities
13-02-2023 - 04:42 03-12-2019 - 14:15
CVE-2013-2121 6.0
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
13-02-2023 - 04:42 31-07-2013 - 13:20
CVE-2011-2908 6.0
Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authe
13-02-2023 - 04:32 23-11-2012 - 20:55
CVE-2012-0874 6.8
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentica
13-02-2023 - 04:32 05-02-2013 - 23:55
CVE-2011-2487 4.3
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
13-02-2023 - 01:19 11-03-2020 - 16:15
CVE-2011-1096 5.0
The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtai
13-02-2023 - 01:18 23-11-2012 - 20:55
CVE-2015-3235 6.0
Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
13-02-2023 - 00:48 14-08-2015 - 18:59
CVE-2015-3155 5.0
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
13-02-2023 - 00:47 14-08-2015 - 18:59
CVE-2014-3531 3.5
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
13-02-2023 - 00:40 18-10-2017 - 14:29
CVE-2014-0208 3.5
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
13-02-2023 - 00:37 16-10-2017 - 18:29
CVE-2014-0192 5.0
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
13-02-2023 - 00:36 08-05-2014 - 14:29
CVE-2014-0090 6.8
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.
13-02-2023 - 00:32 08-05-2014 - 14:29
CVE-2014-0089 4.3
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
13-02-2023 - 00:32 27-03-2014 - 16:55
CVE-2014-0091 5.0
Foreman has improper input validation which could lead to partial Denial of Service
13-02-2023 - 00:32 11-12-2019 - 15:15
CVE-2014-0007 7.5
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
13-02-2023 - 00:29 20-06-2014 - 14:55
CVE-2013-4346 4.3
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.
13-02-2023 - 00:28 20-05-2014 - 14:55
CVE-2013-4386 7.5
Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.
13-02-2023 - 00:28 20-11-2013 - 14:12
CVE-2013-4225 6.8
The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" a
13-02-2023 - 00:28 11-02-2020 - 21:15
CVE-2012-2379 10.0
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impac
13-02-2023 - 00:24 03-01-2013 - 01:55
CVE-2011-4575 4.3
Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to inject arbi
13-02-2023 - 00:21 05-02-2013 - 23:55
CVE-2013-2882 7.5
Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
16-08-2022 - 13:29 31-07-2013 - 13:20
CVE-2014-4616 4.3
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decod
13-07-2022 - 15:04 24-08-2017 - 20:29
CVE-2013-6650 7.5
The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other
30-10-2018 - 16:27 28-01-2014 - 14:30
CVE-2015-1844 4.0
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
13-08-2018 - 21:47 14-08-2015 - 18:59
CVE-2015-1816 5.0
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
13-08-2018 - 21:47 14-08-2015 - 18:59
CVE-2012-3546 4.3
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then
19-09-2017 - 01:35 19-12-2012 - 11:55
CVE-2012-5478 4.9
The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 does not properly restrict access, which allows remote authenticated
29-08-2017 - 01:32 05-02-2013 - 23:55
CVE-2012-3370 5.8
The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a s
29-08-2017 - 01:31 05-02-2013 - 23:55
CVE-2012-3369 4.0
The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via
29-08-2017 - 01:31 05-02-2013 - 23:55
CVE-2012-2377 3.3
JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent
29-08-2017 - 01:31 23-11-2012 - 20:55
CVE-2011-2730 7.5
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via
09-08-2017 - 01:29 05-12-2012 - 17:55
CVE-2014-1704 10.0
Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
07-01-2017 - 02:59 16-03-2014 - 14:06
CVE-2013-7440 4.3
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
28-11-2016 - 19:10 07-06-2016 - 18:59
CVE-2014-3653 4.3
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
08-07-2015 - 16:05 06-07-2015 - 15:59
CVE-2012-0034 2.1
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows l
18-01-2015 - 02:59 05-02-2013 - 23:55
CVE-2014-0135 1.9
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.
09-05-2014 - 16:12 08-05-2014 - 14:29
CVE-2012-6619 6.4
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which
07-05-2014 - 03:45 06-03-2014 - 15:55
CVE-2013-6639 7.5
The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecifi
06-03-2014 - 04:49 07-12-2013 - 00:55
CVE-2013-6640 7.5
The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that se
06-03-2014 - 04:49 07-12-2013 - 00:55
Back to Top Mark selected
Back to Top