Redhat Cloudforms
49 CVEs affecting Redhat Cloudforms. Latest disclosed: 2021-06-07. Critical: 3, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000544 | Critical | 9.8 | 2018-06-26 | rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to t… |
CVE-2018-7750 | Critical | 9.8 | 2018-03-13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3… |
CVE-2020-14325 | Critical | 9.1 | 2020-08-11 | Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-exist… |
CVE-2014-0197 | High | 8.8 | 2019-12-13 | CFME: CSRF protection vulnerability via permissive check of the referrer header |
CVE-2016-5402 | High | 8.8 | 2018-10-31 | A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the c… |
CVE-2016-7071 | High | 8.8 | 2018-09-10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated att… |
CVE-2017-7530 | High | 8.8 | 2018-07-26 | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via fi… |
CVE-2018-1104 | High | 8.8 | 2018-05-02 | Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on… |
CVE-2018-1058 | High | 8.8 | 2018-03-02 | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to… |
CVE-2017-11610 | High | 8.8 | 2017-08-23 | The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbi… |
CVE-2016-4471 | High | 8.8 | 2017-06-08 | ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code. |
CVE-2016-5383 | High | 8.8 | 2016-08-26 | The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters." |
CVE-2017-12148 | High | 8.4 | 2018-07-27 | A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'd… |
CVE-2020-10783 | High | 8.3 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to… |
CVE-2020-25716 | High | 8.1 | 2021-06-07 | A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific… |
CVE-2018-10905 | High | 7.8 | 2018-07-24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile… |
CVE-2019-5419 | High | 7.5 | 2019-03-27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can c… |
CVE-2019-5418 | High | 7.5 | 2019-03-27 | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause… |
CVE-2018-16476 | High | 7.5 | 2018-11-30 | A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using… |
CVE-2018-3760 | High | 7.5 | 2018-06-26 | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted request… |