CVE Feed

    Dashboard / CVE / CVE-2014-3491

    CVE-2014-3491

    Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.

    Published:Jun 18, 2014
    Last Modified:Apr 12, 2025
    EPS:Jul 1, 2014
    EPSS Score:0.00225
    CVSS Score:4.3

    Affected Products

    Vendor
    Theforeman
    Product
    Foreman

    Exploits

    http://projects.theforeman.org/issues/5881http://projects.theforeman.org/issues/5881

    Related CVEs

    CVE-2026-5135 (CVSS 6.5) — A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-e…
    CVE-2025-9572 (CVSS 5) — n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assi…
    CVE-2024-7700 (CVSS 6.5) — A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Inst…
    CVE-2023-4886 (CVSS 6.7) — A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, whi…
    CVE-2022-3874 (CVSS 8) — A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on…
    CVE-2023-0462 (CVSS 8) — An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary…
    CVE-2023-0118 (CVSS 9.1) — An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in t…
    CVE-2020-10710 (CVSS 4.4) — A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through …
    CVE-2021-3584 (CVSS 7.2) — A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could…
    CVE-2021-3590 (CVSS 8.8) — A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High