Cloudforms (Redhat) - vulnerabilities (CVEs)

48 CVEs, 0 in the last 30 days, 25 known versions, newest CVE from 2021-06-07. Vendor: Redhat.

CVEs of Cloudforms

CVE-2020-25716 - CVSS 8.1 (high), 2021-06-07: A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific…
CVE-2020-14369 - CVSS 6.3 (medium), 2020-12-02: This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web…
CVE-2020-10778 - CVSS 6 (medium), 2020-08-11: In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there…
CVE-2020-14325 - CVSS 9.1 (critical), 2020-08-11: Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and…
CVE-2020-10783 - CVSS 8.3 (high), 2020-08-11: Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to…
CVE-2020-10779 - CVSS 6.5 (medium), 2020-08-11: Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check.…
CVE-2020-10777 - CVSS 5.4 (medium), 2020-08-11: A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack…
CVE-2014-0197 - CVSS 8.8 (high), 2019-12-13: CFME: CSRF protection vulnerability via permissive check of the referrer header
CVE-2013-4423 - CVSS 5.5 (medium), 2019-11-04: CloudForms stores user passwords in recoverable format
CVE-2013-0186 - CVSS 6.1 (medium), 2019-11-01: Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-16892 - CVSS 5.5 (medium), 2019-09-25: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This…
CVE-2019-10159 - CVSS 4.3 (medium), 2019-06-14: cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An…
CVE-2017-15123 - CVSS 5.3 (medium), 2019-06-12: A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An…
CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
CVE-2019-5418 - CVSS 7.5 (high), 2019-03-27: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can…
CVE-2019-5419 - CVSS 7.5 (high), 2019-03-27: There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can…
CVE-2018-16476 - CVSS 7.5 (high), 2018-11-30: A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it…
CVE-2016-5402 - CVSS 8.8 (high), 2018-10-31: A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the…
CVE-2016-7047 - CVSS 4.3 (medium), 2018-09-11: A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API…
CVE-2016-7071 - CVSS 8.8 (high), 2018-09-10: It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated…
CVE-2017-2632 - CVSS 4.9 (medium), 2018-07-27: A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level…
CVE-2017-2653 - CVSS 6.5 (medium), 2018-07-27: A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could…
CVE-2017-12148 - CVSS 8.4 (high), 2018-07-27: A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the…
CVE-2017-2639 - CVSS 7.5 (high), 2018-07-27: It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with…
CVE-2017-2664 - CVSS 6.5 (medium), 2018-07-26: CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms.…
CVE-2017-7530 - CVSS 8.8 (high), 2018-07-26: In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via…
CVE-2018-10905 - CVSS 7.8 (high), 2018-07-24: CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an…
CVE-2018-10855 - CVSS 5.9 (medium), 2018-07-03: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect…
CVE-2018-3760 - CVSS 7.5 (high), 2018-06-26: There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted…
CVE-2018-1000544 - CVSS 9.8 (critical), 2018-06-26: rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to…
CVE-2018-11627 - CVSS 6.1 (medium), 2018-05-31: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
CVE-2018-1104 - CVSS 8.8 (high), 2018-05-02: Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on…
CVE-2018-1101 - CVSS 7.2 (high), 2018-05-02: Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System…
CVE-2018-7750 - CVSS 9.8 (critical), 2018-03-13: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3,…
CVE-2018-1058 - CVSS 8.8 (high), 2018-03-02: A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw…
CVE-2017-12191 - CVSS 7.4 (high), 2018-02-28: A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare…
CVE-2018-1053 - CVSS 7 (high), 2018-02-09: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current…
CVE-2017-11610 - CVSS 8.8 (high), 2017-08-23: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute…
CVE-2016-4471 - CVSS 8.8 (high), 2017-06-08: ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
CVE-2016-5383 - CVSS 8.8 (high), 2016-08-26: The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."
CVE-2015-7502 - CVSS 5.1 (medium), 2016-04-11: Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL…
CVE-2014-0057 - CVSS 7.5 (high), 2014-03-18: The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote…
CVE-2014-0081 - CVSS 4.3 (medium), 2014-02-20: Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3,…
CVE-2013-6443 - CVSS 6.8 (medium), 2014-01-23: CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site…
CVE-2012-5604 - CVSS 4.3 (medium), 2013-03-01: The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass…
CVE-2012-4574 - CVSS 2.1 (low), 2013-01-04: Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local users to read the administrative password by reading…
CVE-2012-5605 - CVSS 2.1 (low), 2013-01-04: Grinder in Red Hat CloudForms before 1.1 uses world-writable permissions for /var/lib/pulp/cache/grinder/, which allows local users to modify grinder cache…
CVE-2012-5603 - CVSS 5.5 (medium), 2013-01-04: proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read…
CVE-2012-3538 - CVSS 3.3 (low), 2013-01-04: Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords…