THREATIST.IORead the docs Satellite 6.3 security, bug fix, and enhancement update
Released 2018-02-21 · Red Hat rating Important · View on Red Hat →
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to caus…
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format.
A flaw was found in foreman before version 1.15 in the logging of adding and registering images.
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging.
The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default.
A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0.
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources.
A flaw was found in foreman 1.5.1.
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files.
Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via…
discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to t…
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name.
A vulnerability was found in foreman 1.14.0.
Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host conf…
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modif…
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
A SQL injection flaw was found in katello's errata-related API.
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature.
foreman before 1.14.0 is vulnerable to an information leak.