Known vulnerabilities in Foreman

Vendor: Foreman
Software: Foreman
Software CPE: cpe:2.3:a:foreman:foreman:*:*:*:*:*:*:*:*
Total vulnerabilities: 40
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Foreman Foreman is affected by 40 known vulnerabilities: 6 high, 10 medium, 24 low Critical High Medium Low

Vulnerabilities (40)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118653 - Permissions, Privileges, and Access Controls
CVE-2025-9572
CWE-264 Medium
No
No
- 20.11.2025 SB2025112064
SB2025112134
SB2025112135
and 2 more
#VU99570 - Exposure of sensitive information to an unauthorized actor
CVE-2024-8553
CWE-200 Low
No
No
3.11.4 31.10.2024 SB20241031110
SB2024110111
SB2024110112
and 2 more
#VU84616 - Incorrect Default Permissions
CVE-2023-4886
CWE-276 Low
No
No
3.8.0 20.12.2023 SB2023122040
SB2024030156
#VU78931 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-0118
CWE-78 Low
No
No
- 03.08.2023 SB2023080359
SB2023080360
SB2023102351
and 2 more
#VU76726 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-0119
CWE-79 Low
No
No
3.5.2, 3.6.0 31.05.2023 SB2023053154
SB2023060111
SB2023112747
#VU34978 - Improper input validation
CVE-2014-0091
CWE-20 Medium
No
No
- 11.12.2019 SB2018092123
#VU16891 - Improper Authorization
CVE-2018-14666
CWE-285 Low
No
No
- 08.01.2019 SB2019010903
#VU36315 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-16861
CWE-79 Low
No
No
- 07.12.2018 SB2018120736
#VU15349 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-14664
CWE-79 Low
No
No
- 14.10.2018 SB2018101405
#VU36623 - Improper Authentication
CVE-2018-14643
CWE-287 High
No
No
- 21.09.2018 SB2018092123
SB2018092023
#VU36709 - Exposure of sensitive information to an unauthorized actor
CVE-2016-7077
CWE-200 Low
No
No
1.14.0 10.09.2018 SB2018091018
#VU36805 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-8634
CWE-79 Low
No
No
- 01.08.2018 SB2018080135
#VU36807 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-8613
CWE-79 Low
No
No
- 31.07.2018 SB2018073122
#VU14132 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-7535
CWE-79 Low
No
No
1.16.0 30.07.2018 SB2018073109
#VU11827 - Exposure of sensitive information to an unauthorized actor
CVE-2018-1097
CWE-200 Low
No
No
- 12.04.2018 SB2017121515
#VU11755 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2018-1096
CWE-89 Low
No
No
- 11.04.2018 SB2018032826
#VU37873 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-15100
CWE-79 Low
No
No
1.16.0 27.11.2017 SB2017112717
#VU38131 - Security Features
CVE-2015-5246
CWE-254 High
No
No
- 06.10.2017 SB2017100614
#VU38203 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-5282
CWE-79 Low
No
No
- 25.09.2017 SB2017092507
#VU38713 - Exposure of sensitive information to an unauthorized actor
CVE-2015-5152
CWE-200 High
No
No
- 17.07.2017 SB2017071725


Showing elements 1 - 20 out of 40