CVE-2017-7535

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

• CWE-79
• CWE-79

• http://seclists.org/oss-sec/2017/q3/521Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/99604Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7535Issue Tracking, Third Party Advisory
• https://projects.theforeman.org/issues/20963Vendor Advisory
• http://seclists.org/oss-sec/2017/q3/521Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/99604Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7535Issue Tracking, Third Party Advisory
• https://projects.theforeman.org/issues/20963Vendor Advisory

Published

Jul 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7529Nginx versions since 0.5.6 up to and including 1.13.2 are vu…7.5
• CVE-2017-7530In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.…8.8
• CVE-2017-7531In Moodle 3.3, the course overview block reveals activities …
• CVE-2017-7532In Moodle 3.x, course creators are able to change system def…
• CVE-2017-7533Race condition in the fsnotify implementation in the Linux k…7
• CVE-2017-7534OpenShift Enterprise version 3.x is vulnerable to a stored X…
• CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and …7
• CVE-2017-7537It was found that a mock CMC authentication plugin with a ha…5.9
• CVE-2017-7538A cross-site scripting (XSS) flaw was found in how an organi…3.5
• CVE-2017-7539An assertion-failure flaw was found in Qemu before 2.10.1, i…5.3
• CVE-2017-7540rubygem-safemode, as used in Foreman, versions 1.3.2 and ear…
• CVE-2017-7541The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/…7.8