Cloudforms Management Engine (Redhat) - vulnerabilities (CVEs)

42 CVEs, 0 in the last 30 days, 30 known versions, newest CVE from 2022-07-06. Vendor: Redhat.

CVEs of Cloudforms Management Engine

• CVE-2014-8164 - CVSS 9.1 (critical), 2022-07-06: A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.
• CVE-2020-14324 - CVSS 9.1 (critical), 2020-08-11: A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can…
• CVE-2020-14296 - CVSS 7.1 (high), 2020-08-11: Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan…
• CVE-2020-10780 - CVSS 6.3 (medium), 2020-08-11: Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel.…
• CVE-2019-14894 - CVSS 8 (high), 2020-06-22: A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS…
• CVE-2019-14905 - CVSS 7.3 (high), 2020-03-31: A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's…
• CVE-2020-1738 - CVSS 3.9 (low), 2020-03-16: A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a…
• CVE-2020-1740 - CVSS 4.7 (medium), 2020-03-16: A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same…
• CVE-2020-1736 - CVSS 3.3 (low), 2020-03-16: A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files…
• CVE-2020-1735 - CVSS 4.6 (medium), 2020-03-16: A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new…
• CVE-2020-1739 - CVSS 3.9 (low), 2020-03-12: A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is…
• CVE-2020-1733 - CVSS 5 (medium), 2020-03-11: A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user.…
• CVE-2012-6685 - CVSS 7.5 (high), 2020-02-19: Nokogiri before 1.5.4 is vulnerable to XXE attacks
• CVE-2019-14864 - CVSS 6.5 (medium), 2020-01-02: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when…
• CVE-2014-3536 - CVSS 5.5 (medium), 2019-12-15: CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
• CVE-2014-0197 - CVSS 8.8 (high), 2019-12-13: CFME: CSRF protection vulnerability via permissive check of the referrer header
• CVE-2018-10854 - CVSS 6.5 (medium), 2019-11-22: cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping…
• CVE-2013-6461 - CVSS 6.5 (medium), 2019-11-05: Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
• CVE-2013-6460 - CVSS 6.5 (medium), 2019-11-05: Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
• CVE-2019-10177 - CVSS 6.5 (medium), 2019-06-27: A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not…
• CVE-2017-15123 - CVSS 5.3 (medium), 2019-06-12: A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An…
• CVE-2016-5402 - CVSS 8.8 (high), 2018-10-31: A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the…
• CVE-2016-7047 - CVSS 4.3 (medium), 2018-09-11: A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API…
• CVE-2016-7071 - CVSS 8.8 (high), 2018-09-10: It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated…
• CVE-2017-7528 - CVSS 6.5 (medium), 2018-08-22: Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal…
• CVE-2017-2632 - CVSS 4.9 (medium), 2018-07-27: A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level…
• CVE-2017-2653 - CVSS 6.5 (medium), 2018-07-27: A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could…
• CVE-2017-7497 - CVSS 4.3 (medium), 2018-07-27: The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage…
• CVE-2017-15125 - CVSS 6.5 (medium), 2018-07-27: A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript…
• CVE-2017-2639 - CVSS 7.5 (high), 2018-07-27: It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with…
• CVE-2017-2664 - CVSS 6.5 (medium), 2018-07-26: CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms.…
• CVE-2017-7530 - CVSS 8.8 (high), 2018-07-26: In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via…
• CVE-2018-10905 - CVSS 7.8 (high), 2018-07-24: CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an…
• CVE-2013-2049 - CVSS 7.5 (high), 2018-05-01: Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.
• CVE-2014-0087 - CVSS 8.8 (high), 2018-01-11: The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows…
• CVE-2016-4457 - CVSS 7.5 (high), 2017-06-08: CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
• CVE-2016-3702 - CVSS 5.3 (medium), 2017-04-21: Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
• CVE-2016-7040 - CVSS 8.8 (high), 2016-10-07: Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI,…
• CVE-2015-7502 - CVSS 5.1 (medium), 2016-04-11: Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL…
• CVE-2013-2050 - CVSS 7.5 (high), 2014-01-11: SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager…
• CVE-2013-2068 - CVSS 9.4 (critical), 2013-09-28: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite…
• CVE-2013-4172 - CVSS 8.5 (high), 2013-08-23: The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.