Overview 94 matches · 0 in Waratek scope · 0 protected · 4 exploited · 1 CISA KEV · 6 public PoC · 4 EPSS ≥ 0.5
94matches
0in Waratek scope0.0%
0protected0.0%
4exploited4.3%
1CISA KEV1.1%
6public PoC6.4%
4EPSS ≥ 0.54.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
5
5.3%
Not applicable
89
94.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
94
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
4
4.3%
Working exploit published
2
2.1%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
88
93.6%
split by
peak 26 / year
20139
Not applicable9
High2
Medium3
Low4
not blocked9
Working exploit published1
No public exploit8
201414
Not applicable14
High2
Medium12
not blocked14
No public exploit14
20152
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20163
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20175
Not applicable5
High3
Medium2
not blocked5
Exploited1
No public exploit4
201826
Not applicable26
Critical2
High15
Medium9
not blocked26
Exploited1
Working exploit published1
No public exploit24
201914
Outside Waratek scope4
Not applicable10
High3
Medium11
not blocked14
Exploited2
No public exploit12
202019
Outside Waratek scope1
Not applicable18
Critical2
High4
Medium10
Low3
not blocked19
No public exploit19
20211
Not applicable1
High1
not blocked1
No public exploit1
20221
Not applicable1
Critical1
not blocked1
No public exploit1
2013201420152016201720182019202020212022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2014-8164 | Critical | 2022-07-06 | Not applicable | No public exploit | A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x. |
| CVE-2020-25716 | High | 2021-06-07 | Not applicable | No public exploit | A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected |
| CVE-2020-14369 | Medium | 2020-12-02 | Not applicable | No public exploit | This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth. |
| CVE-2020-14325 | Critical | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator. |
| CVE-2020-14324 | Critical | 2020-08-11 | Not applicable | No public exploit | A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server. |
| CVE-2020-14296 | High | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible. |
| CVE-2020-10783 | High | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files. |
| CVE-2020-10780 | Medium | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities. |
| CVE-2020-10779 | Medium | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms. |
| CVE-2020-10778 | Medium | 2020-08-11 | Not applicable | No public exploit | In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior. |
| CVE-2020-10777 | Medium | 2020-08-11 | Not applicable | No public exploit | A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. |
| CVE-2019-14894 | High | 2020-06-22 | Not applicable | No public exploit | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root. |
| CVE-2019-14905 | Medium | 2020-03-31 | Not applicable | No public exploit | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues. |
| CVE-2020-1740 | Medium | 2020-03-16 | Not applicable | No public exploit | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1738 | Low | 2020-03-16 | Not applicable | No public exploit | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1736 | Low | 2020-03-16 | Not applicable | No public exploit | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1735 | Medium | 2020-03-16 | Not applicable | No public exploit | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1739 | Low | 2020-03-12 | Not applicable | No public exploit | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs. |
| CVE-2020-1733 | Medium | 2020-03-11 | Not applicable | No public exploit | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'. |
| CVE-2012-6685 | High | 2020-02-19 | Outside Waratek scope | No public exploit | Nokogiri before 1.5.4 is vulnerable to XXE attacks |
| CVE-2019-14864 | Medium | 2020-01-02 | Not applicable | No public exploit | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. |
| CVE-2014-3536 | Medium | 2019-12-15 | Not applicable | No public exploit | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
| CVE-2014-0197 | High | 2019-12-13 | Not applicable | No public exploit | CFME: CSRF protection vulnerability via permissive check of the referrer header |
| CVE-2018-10854 | Medium | 2019-11-22 | Not applicable | No public exploit | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. |
| CVE-2013-6461 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
| CVE-2013-6460 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
| CVE-2013-4423 | Medium | 2019-11-04 | Not applicable | No public exploit | CloudForms stores user passwords in recoverable format |
| CVE-2013-0186 | Medium | 2019-11-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2019-16892 | Medium | 2019-09-25 | Not applicable | No public exploit | In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). |
| CVE-2019-10177 | Medium | 2019-06-27 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. |
| CVE-2019-10159 | Medium | 2019-06-14 | Not applicable | No public exploit | cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. |
| CVE-2017-15123 | Medium | 2019-06-12 | Not applicable | No public exploit | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines. |
| CVE-2019-11358 | Medium | 2019-04-20 | Outside Waratek scope | Exploited | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. |
| CVE-2019-5419 | High | 2019-03-27 | Outside Waratek scope | No public exploit | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive. |
| CVE-2019-5418 | High | 2019-03-27 | Not applicable | Exploited | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. |
| CVE-2018-16476 | High | 2018-11-30 | Not applicable | No public exploit | A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1. |
| CVE-2016-5402 | High | 2018-10-31 | Not applicable | No public exploit | A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. |
| CVE-2016-7047 | Medium | 2018-09-11 | Not applicable | No public exploit | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access. |
| CVE-2016-7071 | High | 2018-09-10 | Not applicable | No public exploit | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM. |
| CVE-2017-7528 | Medium | 2018-08-22 | Not applicable | No public exploit | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback). |
| CVE-2017-7497 | Medium | 2018-07-27 | Not applicable | No public exploit | The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. |
| CVE-2017-2653 | Medium | 2018-07-27 | Not applicable | No public exploit | A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute. |
| CVE-2017-2639 | High | 2018-07-27 | Not applicable | No public exploit | It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms. |
| CVE-2017-2632 | Medium | 2018-07-27 | Not applicable | No public exploit | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges. |
| CVE-2017-15125 | Medium | 2018-07-27 | Not applicable | No public exploit | A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP. |
| CVE-2017-12148 | High | 2018-07-27 | Not applicable | No public exploit | A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as. |
| CVE-2017-7530 | High | 2018-07-26 | Not applicable | No public exploit | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs). |
| CVE-2017-2664 | Medium | 2018-07-26 | Not applicable | No public exploit | CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges. |
| CVE-2018-10905 | High | 2018-07-24 | Not applicable | No public exploit | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user. |
| CVE-2018-10855 | Medium | 2018-07-03 | Not applicable | No public exploit | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. |
| CVE-2018-3760 | High | 2018-06-26 | Not applicable | Exploited | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. |
| CVE-2018-1000544 | Critical | 2018-06-26 | Not applicable | No public exploit | rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.. |
| CVE-2018-11627 | Medium | 2018-05-31 | Not applicable | No public exploit | Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. |
| CVE-2018-1104 | High | 2018-05-02 | Not applicable | No public exploit | Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server. |
| CVE-2018-1101 | High | 2018-05-02 | Not applicable | No public exploit | Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system. |
| CVE-2013-2049 | High | 2018-05-01 | Not applicable | No public exploit | Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret. |
| CVE-2018-7750 | Critical | 2018-03-13 | Not applicable | Working exploit published | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. |
| CVE-2018-1058 | High | 2018-03-02 | Not applicable | No public exploit | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. |
| CVE-2017-12191 | High | 2018-02-28 | Not applicable | No public exploit | A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to. |
| CVE-2018-1053 | High | 2018-02-09 | Not applicable | No public exploit | In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file. |
| CVE-2014-0087 | High | 2018-01-11 | Not applicable | No public exploit | The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action. |
| CVE-2014-7813 | Medium | 2017-10-18 | Not applicable | No public exploit | Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols. |
| CVE-2017-11610 | High | 2017-08-23 | Not applicable | Exploited | The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. |
| CVE-2016-4471 | High | 2017-06-08 | Not applicable | No public exploit | ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code. |
| CVE-2016-4457 | High | 2017-06-08 | Not applicable | No public exploit | CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. |
| CVE-2016-3702 | Medium | 2017-04-21 | Not applicable | No public exploit | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. |
| CVE-2016-7040 | High | 2016-10-07 | Not applicable | No public exploit | Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections. |
| CVE-2016-5383 | High | 2016-08-26 | Not applicable | No public exploit | The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters." |
| CVE-2015-7502 | Medium | 2016-04-11 | Not applicable | No public exploit | Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files. |
| CVE-2014-7814 | Medium | 2015-01-16 | Not applicable | No public exploit | SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter. |
| CVE-2014-3692 | High | 2015-01-16 | Not applicable | No public exploit | The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges. |
| CVE-2014-0136 | Medium | 2014-10-27 | Not applicable | No public exploit | The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors. |
| CVE-2014-3642 | Medium | 2014-10-06 | Not applicable | No public exploit | vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method." |
| CVE-2014-0140 | Medium | 2014-10-06 | Not applicable | No public exploit | Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request. |
| CVE-2014-3489 | Medium | 2014-07-07 | Not applicable | No public exploit | lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack. |
| CVE-2014-3486 | Medium | 2014-07-07 | Not applicable | No public exploit | The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name. |
| CVE-2014-0184 | Medium | 2014-07-07 | Not applicable | No public exploit | Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file. |
| CVE-2014-0180 | Medium | 2014-07-07 | Not applicable | No public exploit | The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors. |
| CVE-2014-0176 | Medium | 2014-07-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-0137 | Medium | 2014-05-14 | Not applicable | No public exploit | SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists. |
| CVE-2014-0078 | Medium | 2014-05-14 | Not applicable | No public exploit | The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID. |
| CVE-2014-0057 | High | 2014-03-18 | Not applicable | No public exploit | The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors. |
| CVE-2014-0081 | Medium | 2014-02-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. |
| CVE-2013-6443 | Medium | 2014-01-23 | Not applicable | No public exploit | CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request. |
| CVE-2013-2050 | High | 2014-01-11 | Not applicable | No public exploit | SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action. |
| CVE-2013-2068 | High | 2013-09-28 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method. |
| CVE-2013-4172 | High | 2013-08-23 | Not applicable | No public exploit | The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors. |
| CVE-2012-6117 | Low | 2013-03-12 | Not applicable | No public exploit | Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file. |
| CVE-2012-5509 | Low | 2013-03-12 | Not applicable | No public exploit | aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read credentials by reading this file. |
| CVE-2012-5604 | Medium | 2013-03-01 | Not applicable | No public exploit | The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors. |
| CVE-2012-5605 | Low | 2013-01-04 | Not applicable | No public exploit | A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthorized data tampering within the application's cache. |
| CVE-2012-5603 | Medium | 2013-01-04 | Not applicable | No public exploit | proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system. |
| CVE-2012-4574 | Medium | 2013-01-04 | Not applicable | No public exploit | A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials. |
| CVE-2012-3538 | Low | 2013-01-04 | Not applicable | No public exploit | Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log. |