Redhat Cloudforms_management_engine
42 CVEs affecting Redhat Cloudforms_management_engine. Latest disclosed: 2022-07-06. Critical: 2, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-8164 | Critical | 9.1 | 2022-07-06 | A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x. |
CVE-2020-14324 | Critical | 9.1 | 2020-08-11 | A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be… |
CVE-2014-0197 | High | 8.8 | 2019-12-13 | CFME: CSRF protection vulnerability via permissive check of the referrer header |
CVE-2016-5402 | High | 8.8 | 2018-10-31 | A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the c… |
CVE-2016-7071 | High | 8.8 | 2018-09-10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated att… |
CVE-2017-7530 | High | 8.8 | 2018-07-26 | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via fi… |
CVE-2014-0087 | High | 8.8 | 2018-01-11 | The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remot… |
CVE-2016-7040 | High | 8.8 | 2016-10-07 | Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, wh… |
CVE-2019-14894 | High | 8.0 | 2020-06-22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch… |
CVE-2018-10905 | High | 7.8 | 2018-07-24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile… |
CVE-2012-6685 | High | 7.5 | 2020-02-19 | Nokogiri before 1.5.4 is vulnerable to XXE attacks |
CVE-2013-2049 | High | 7.5 | 2018-05-01 | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret. |
CVE-2016-4457 | High | 7.5 | 2017-06-08 | CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. |
CVE-2020-14296 | High | 7.1 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan a… |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2019-10177 | Medium | 6.5 | 2019-06-27 | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly… |
CVE-2017-15125 | Medium | 6.5 | 2018-07-27 | A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript i… |
CVE-2017-2639 | Medium | 6.5 | 2018-07-27 | It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with… |