CVE-2016-8613

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

• CWE-79
• CWE-79

• http://www.securityfocus.com/bid/93859Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613Issue Tracking, Patch, Third Party Advisory
• https://github.com/theforeman/foreman_remote_execution/pull/208Third Party Advisory
• https://projects.theforeman.org/issues/17066/Vendor Advisory
• http://www.securityfocus.com/bid/93859Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613Issue Tracking, Patch, Third Party Advisory
• https://github.com/theforeman/foreman_remote_execution/pull/208Third Party Advisory
• https://projects.theforeman.org/issues/17066/Vendor Advisory

Published

Jul 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8606The REPL server (--listen) in GNU Guile 2.0.12 allows an att…
• CVE-2016-8608JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS …5.4
• CVE-2016-8609It was found that the keycloak before 2.3.0 did not implemen…3.7
• CVE-2016-8610A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, …7.5
• CVE-2016-8611A vulnerability was found in Openstack Glance. No limits are…4.3
• CVE-2016-8612Apache HTTP Server mod_cluster before version httpd 2.4.23 i…
• CVE-2016-8614A flaw was found in Ansible before version 2.2.0. The apt_ke…6.3
• CVE-2016-8615A flaw was found in curl before version 7.51. If cookie stat…5.3
• CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using…3.7
• CVE-2016-8617The base64 encode function in curl before version 7.51.0 is …3.3
• CVE-2016-8618The libcurl API function called `curl_maprintf()` before ver…5.3
• CVE-2016-8619The function `read_data()` in security.c in curl before vers…5.3