WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product cloudforms management engine✕
Overview 16 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
16matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC6.2% 1EPSS ≥ 0.56.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 6.2% Not applicable 15 93.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 16 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 6.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 93.8%
split by peak 7 / year
Not applicable: 15Outside Waratek scope: 1 High: 16 not blocked: 16 No public exploit: 15Working exploit published: 1
20132 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20141 Not applicable1 High1 not blocked1 No public exploit1 20150 20161 Not applicable1 High1 not blocked1 No public exploit1 20171 Not applicable1 High1 not blocked1 No public exploit1 20187 Not applicable7 High7 not blocked7 No public exploit7 20191 Not applicable1 High1 not blocked1 No public exploit1 20203 Outside Waratek scope1 Not applicable2 High3 not blocked3 No public exploit3
20132014201520162017201820192020
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-14296 High 2020-08-11 Not applicable No public exploit Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.
CVE-2019-14894 High 2020-06-22 Not applicable No public exploit A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
CVE-2012-6685 High 2020-02-19 Outside Waratek scope No public exploit Nokogiri before 1.5.4 is vulnerable to XXE attacks
CVE-2014-0197 High 2019-12-13 Not applicable No public exploit CFME: CSRF protection vulnerability via permissive check of the referrer header
CVE-2016-5402 High 2018-10-31 Not applicable No public exploit A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
CVE-2016-7071 High 2018-09-10 Not applicable No public exploit It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.
CVE-2017-2639 High 2018-07-27 Not applicable No public exploit It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.
CVE-2017-7530 High 2018-07-26 Not applicable No public exploit In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
CVE-2018-10905 High 2018-07-24 Not applicable No public exploit CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.
CVE-2013-2049 High 2018-05-01 Not applicable No public exploit Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.
CVE-2014-0087 High 2018-01-11 Not applicable No public exploit The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.
CVE-2016-4457 High 2017-06-08 Not applicable No public exploit CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
CVE-2016-7040 High 2016-10-07 Not applicable No public exploit Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.
CVE-2013-2050 High 2014-01-11 Not applicable No public exploit SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.
CVE-2013-2068 High 2013-09-28 Not applicable Working exploit published Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVE-2013-4172 High 2013-08-23 Not applicable No public exploit The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.