Dominic Cleal

The issue allows remote attackers to obtain user credentials via a man-in-the-middle attack because HTTP requests are not redirected to HTTPS when the require ssl setting is set to true.

The issue allows remote authenticated users with the `edit users` permission to edit administrator users and change their passwords. An attacker with the `edit users` permission could use this flaw to access an admin user account, leading to an escalation of privileges.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page. This is related to create, update, and destroy notification boxes.

The issue allows remote attackers to inject arbitrary web script or HTML via a parameter related to the host, specifically the `name` or `value`. This can be exploited to conduct cross-site scripting (XSS) attacks.

The issue allows local users to obtain the private key by reading the file due to world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node.

The issue concerns the smart proxy in Foreman, where a umask set to 0 allows local users to modify files created by the daemon.