In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py python-jinja2: Sandbox escape due to information disclosure via str.format rubygem-rack: Buffer size in multipart parser allows for denial of service dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents foreman: Recover of plaintext password or token for the compute resources foreman: authorization bypasses in foreman-tasks leading to information disclosure python-jinja2: str.format_map allows sandbox escape python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods katello: registry credentials are captured in plain text during repository discovery