[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fljNushUSFRgHWwQagQqH75Ligw7hI-SOd0mQCrFsvTg":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":78,"kevVulnerabilities":140,"topProductsByCves":141,"seoMetadata":152,"meta":161},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":77},31637,"theforeman",12,90,0,981,"2024-08-12","t",[16,21,27,33,37,43,48,53,58,63,68,72],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},162442,"foreman",178,69,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},162450,"katello",543,10,"2019-12-10",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},162448,"hammer_cli",56,2,"2019-12-13",{"id":34,"product_name":35,"version_count":11,"cve_count":31,"kev_count":11,"last_cve_update":36},162443,"foreman_ansible","2022-03-23",{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":11,"last_cve_update":42},162453,"smart_proxy_shell_hooks",3,1,"2021-05-12",{"id":44,"product_name":45,"version_count":46,"cve_count":41,"kev_count":11,"last_cve_update":47},162447,"foreman-tasks",29,"2019-07-31",{"id":49,"product_name":50,"version_count":51,"cve_count":41,"kev_count":11,"last_cve_update":52},162446,"foremanfogproxmox",31,"2021-06-07",{"id":54,"product_name":55,"version_count":56,"cve_count":41,"kev_count":11,"last_cve_update":57},162449,"kafo",45,"2014-05-08",{"id":59,"product_name":60,"version_count":61,"cve_count":41,"kev_count":11,"last_cve_update":62},162444,"foreman_azurerm",19,"2021-04-08",{"id":64,"product_name":65,"version_count":66,"cve_count":41,"kev_count":11,"last_cve_update":67},162451,"openscap",32,"2022-03-25",{"id":69,"product_name":70,"version_count":25,"cve_count":41,"kev_count":11,"last_cve_update":71},162452,"smart_proxy_salt","2022-03-30",{"id":73,"product_name":74,"version_count":75,"cve_count":11,"kev_count":11,"last_cve_update":76},162445,"foreman_discovery_image",35,null,"Theforeman is a technology vendor with 12 tracked products and 90 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[79,88,94,98,105,113,120,125,129,135],{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":84,"severity":85,"isKev":86,"epssScore":87},"CVE-2013-2143","The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.","2014-04-17",6.5,"v2","Medium",false,0.48221,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":92,"cvssVersion":84,"severity":85,"isKev":86,"epssScore":93},"CVE-2013-2121","Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.","2013-07-31",6,0.24782,{"cveId":95,"description":96,"publishedDate":91,"cvssScore":92,"cvssVersion":84,"severity":85,"isKev":86,"epssScore":97},"CVE-2013-2113","The create method in app\u002Fcontrollers\u002Fusers_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.",0.20934,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":102,"cvssVersion":84,"severity":103,"isKev":86,"epssScore":104},"CVE-2014-0007","The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp\u002Ffetch_boot_file.","2014-06-20",7.5,"High",0.09017,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":110,"severity":111,"isKev":86,"epssScore":112},"CVE-2018-14643","An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.","2018-09-21",9.8,"v3.0","Critical",0.06056,{"cveId":114,"description":115,"publishedDate":116,"cvssScore":117,"cvssVersion":118,"severity":103,"isKev":86,"epssScore":119},"CVE-2021-3584","A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.","2021-12-23",7.2,"v3.1",0.04042,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":109,"cvssVersion":118,"severity":111,"isKev":86,"epssScore":124},"CVE-2012-3503","The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.","2012-08-25",0.03002,{"cveId":126,"description":127,"publishedDate":57,"cvssScore":102,"cvssVersion":84,"severity":103,"isKev":86,"epssScore":128},"CVE-2013-0171","Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.",0.02974,{"cveId":130,"description":131,"publishedDate":132,"cvssScore":133,"cvssVersion":110,"severity":103,"isKev":86,"epssScore":134},"CVE-2016-3728","Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp\u002F.","2016-05-20",8.8,0.02839,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":133,"cvssVersion":110,"severity":103,"isKev":86,"epssScore":139},"CVE-2016-4475","The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.","2016-08-19",0.02672,[],[142,143,144,145,146,147,148,149,150,151],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},{"id":34,"product_name":35,"version_count":11,"cve_count":31,"kev_count":11,"last_cve_update":36},{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":11,"last_cve_update":42},{"id":44,"product_name":45,"version_count":46,"cve_count":41,"kev_count":11,"last_cve_update":47},{"id":49,"product_name":50,"version_count":51,"cve_count":41,"kev_count":11,"last_cve_update":52},{"id":54,"product_name":55,"version_count":56,"cve_count":41,"kev_count":11,"last_cve_update":57},{"id":59,"product_name":60,"version_count":61,"cve_count":41,"kev_count":11,"last_cve_update":62},{"id":64,"product_name":65,"version_count":66,"cve_count":41,"kev_count":11,"last_cve_update":67},{"title":153,"metaDescription":154,"keywords":155,"structuredData":156},"Theforeman - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Theforeman covering 12 products with 90 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Theforeman vulnerabilities, Theforeman security, Theforeman CVE, Theforeman threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":157,"@type":158,"name":159,"description":154,"url":160},"https:\u002F\u002Fschema.org","Organization","Theforeman","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ftheforeman",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":162,"apiVersion":163},"2026-10-17T17:00:19.992Z","3.0"]