Theforeman vulnerabilitiesNone on the known-exploited list.
Theforeman has 90 published vulnerabilities across 12 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Foreman, with 69. If you run Theforeman software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Theforeman products have the most vulnerabilities?
Foreman leads with 69 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Theforeman vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Theforeman's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Theforeman flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 48%CVE-2013-2143Medium
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user...
- 25%CVE-2013-2121Medium
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a...
- 21%CVE-2013-2113Medium
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag...
- 9.0%CVE-2014-0007High
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
- 6.1%CVE-2018-14643Critical
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman.
- 4.0%CVE-2021-3584High
A server side remote code execution vulnerability was found in Foreman project.
- 3.0%CVE-2012-3503Critical
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote...
- 3.0%CVE-2013-0171High
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
- 2.8%CVE-2016-3728High
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion...
- 2.7%CVE-2016-4475High
The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or...
All Theforeman products we track.
11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Foremanforeman69 vulnerabilities178 versions
- Katellokatello10 vulnerabilities543 versions
- Hammer CLIhammer_cli2 vulnerabilities56 versions
- Foreman Azurermforeman_azurerm1 vulnerability19 versions
- Foreman-Tasksforeman-tasks1 vulnerability29 versions
- Foremanfogproxmoxforemanfogproxmox1 vulnerability31 versions
- Kafokafo1 vulnerability45 versions
- Openscapopenscap1 vulnerability32 versions
- Smart Proxy Saltsmart_proxy_salt1 vulnerability10 versions
- Smart Proxy Shell Hookssmart_proxy_shell_hooks1 vulnerability3 versions
- Foreman Discovery Imageforeman_discovery_image0 vulnerabilities35 versions
This directory lists the 11 Theforeman products with at least one tracked version, of 12 in our catalogue.
Running Theforeman? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
- Matched to
- Katello on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 90 published vulnerabilities across 12 products and 981 versions from Theforeman.
None of Theforeman's vulnerabilities is on the list of flaws known to be exploited today.
Foreman, with 69 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Theforeman products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.