| Max CVSS | 6.0 | Min CVSS | 4.0 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2013-4347 | 5.8 |
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.
|
13-02-2023 - 04:46 | 20-05-2014 - 14:55 | |
| CVE-2015-3235 | 6.0 |
Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
|
13-02-2023 - 00:48 | 14-08-2015 - 18:59 | |
| CVE-2015-3155 | 5.0 |
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
|
13-02-2023 - 00:47 | 14-08-2015 - 18:59 | |
| CVE-2013-4346 | 4.3 |
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.
|
13-02-2023 - 00:28 | 20-05-2014 - 14:55 | |
| CVE-2015-1844 | 4.0 |
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
|
13-08-2018 - 21:47 | 14-08-2015 - 18:59 | |
| CVE-2015-1816 | 5.0 |
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
|
13-08-2018 - 21:47 | 14-08-2015 - 18:59 | |
| CVE-2014-3653 | 4.3 |
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
|
08-07-2015 - 16:05 | 06-07-2015 - 15:59 |