Overview 49 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
49matches
0in Waratek scope0.0%
0protected0.0%
1exploited2.0%
0CISA KEV0.0%
1public PoC2.0%
1EPSS ≥ 0.52.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
3
6.1%
Not applicable
46
93.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
49
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
2.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
48
98.0%
split by
peak 12 / year
20133
Not applicable3
Medium3
not blocked3
No public exploit3
201412
Not applicable12
Medium12
not blocked12
No public exploit12
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20172
Not applicable2
Medium2
not blocked2
No public exploit2
20189
Not applicable9
Medium9
not blocked9
No public exploit9
201911
Outside Waratek scope3
Not applicable8
Medium11
not blocked11
Exploited1
No public exploit10
202010
Not applicable10
Medium10
not blocked10
No public exploit10
20132014201520162017201820192020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-14369 | Medium | 2020-12-02 | Not applicable | No public exploit | This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth. |
| CVE-2020-10780 | Medium | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities. |
| CVE-2020-10779 | Medium | 2020-08-11 | Not applicable | No public exploit | Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms. |
| CVE-2020-10778 | Medium | 2020-08-11 | Not applicable | No public exploit | In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior. |
| CVE-2020-10777 | Medium | 2020-08-11 | Not applicable | No public exploit | A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. |
| CVE-2019-14905 | Medium | 2020-03-31 | Not applicable | No public exploit | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues. |
| CVE-2020-1740 | Medium | 2020-03-16 | Not applicable | No public exploit | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1735 | Medium | 2020-03-16 | Not applicable | No public exploit | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. |
| CVE-2020-1733 | Medium | 2020-03-11 | Not applicable | No public exploit | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'. |
| CVE-2019-14864 | Medium | 2020-01-02 | Not applicable | No public exploit | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. |
| CVE-2014-3536 | Medium | 2019-12-15 | Not applicable | No public exploit | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
| CVE-2018-10854 | Medium | 2019-11-22 | Not applicable | No public exploit | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. |
| CVE-2013-6461 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
| CVE-2013-6460 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
| CVE-2013-4423 | Medium | 2019-11-04 | Not applicable | No public exploit | CloudForms stores user passwords in recoverable format |
| CVE-2013-0186 | Medium | 2019-11-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2019-16892 | Medium | 2019-09-25 | Not applicable | No public exploit | In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). |
| CVE-2019-10177 | Medium | 2019-06-27 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. |
| CVE-2019-10159 | Medium | 2019-06-14 | Not applicable | No public exploit | cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. |
| CVE-2017-15123 | Medium | 2019-06-12 | Not applicable | No public exploit | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines. |
| CVE-2019-11358 | Medium | 2019-04-20 | Outside Waratek scope | Exploited | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. |
| CVE-2016-7047 | Medium | 2018-09-11 | Not applicable | No public exploit | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access. |
| CVE-2017-7528 | Medium | 2018-08-22 | Not applicable | No public exploit | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback). |
| CVE-2017-7497 | Medium | 2018-07-27 | Not applicable | No public exploit | The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. |
| CVE-2017-2653 | Medium | 2018-07-27 | Not applicable | No public exploit | A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute. |
| CVE-2017-2632 | Medium | 2018-07-27 | Not applicable | No public exploit | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges. |
| CVE-2017-15125 | Medium | 2018-07-27 | Not applicable | No public exploit | A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP. |
| CVE-2017-2664 | Medium | 2018-07-26 | Not applicable | No public exploit | CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges. |
| CVE-2018-10855 | Medium | 2018-07-03 | Not applicable | No public exploit | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. |
| CVE-2018-11627 | Medium | 2018-05-31 | Not applicable | No public exploit | Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. |
| CVE-2014-7813 | Medium | 2017-10-18 | Not applicable | No public exploit | Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols. |
| CVE-2016-3702 | Medium | 2017-04-21 | Not applicable | No public exploit | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. |
| CVE-2015-7502 | Medium | 2016-04-11 | Not applicable | No public exploit | Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files. |
| CVE-2014-7814 | Medium | 2015-01-16 | Not applicable | No public exploit | SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter. |
| CVE-2014-0136 | Medium | 2014-10-27 | Not applicable | No public exploit | The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors. |
| CVE-2014-3642 | Medium | 2014-10-06 | Not applicable | No public exploit | vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method." |
| CVE-2014-0140 | Medium | 2014-10-06 | Not applicable | No public exploit | Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request. |
| CVE-2014-3489 | Medium | 2014-07-07 | Not applicable | No public exploit | lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack. |
| CVE-2014-3486 | Medium | 2014-07-07 | Not applicable | No public exploit | The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name. |
| CVE-2014-0184 | Medium | 2014-07-07 | Not applicable | No public exploit | Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file. |
| CVE-2014-0180 | Medium | 2014-07-07 | Not applicable | No public exploit | The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors. |
| CVE-2014-0176 | Medium | 2014-07-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-0137 | Medium | 2014-05-14 | Not applicable | No public exploit | SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists. |
| CVE-2014-0078 | Medium | 2014-05-14 | Not applicable | No public exploit | The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID. |
| CVE-2014-0081 | Medium | 2014-02-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. |
| CVE-2013-6443 | Medium | 2014-01-23 | Not applicable | No public exploit | CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request. |
| CVE-2012-5604 | Medium | 2013-03-01 | Not applicable | No public exploit | The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors. |
| CVE-2012-5603 | Medium | 2013-01-04 | Not applicable | No public exploit | proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system. |
| CVE-2012-4574 | Medium | 2013-01-04 | Not applicable | No public exploit | A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials. |