Filtered by vendor Redhat Subscriptions
Filtered by product Cloudforms Management Engine Subscriptions
Total 42 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2012-6685 2 Nokogiri, Redhat 9 Nokogiri, Cloudforms Management Engine, Cloudforms Managementengine and 6 more 2024-08-06 7.5 High
Nokogiri before 1.5.4 is vulnerable to XXE attacks
CVE-2013-6460 3 Debian, Nokogiri, Redhat 7 Debian Linux, Nokogiri, Cloudforms Management Engine and 4 more 2024-08-06 6.5 Medium
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
CVE-2013-6461 3 Debian, Nokogiri, Redhat 7 Debian Linux, Nokogiri, Cloudforms Management Engine and 4 more 2024-08-06 6.5 Medium
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
CVE-2013-4172 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.
CVE-2013-2068 1 Redhat 2 Cloudforms, Cloudforms Management Engine 2024-08-06 N/A
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVE-2013-2049 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.
CVE-2013-2050 1 Redhat 3 Cloudforms Management Engine, Cloudforms Managementengine, Manageiq Enterprise Virtualization Manager 2024-08-06 N/A
SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.
CVE-2014-8164 1 Redhat 1 Cloudforms Management Engine 2024-08-06 9.1 Critical
A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.
CVE-2014-3536 1 Redhat 1 Cloudforms Management Engine 2024-08-06 5.5 Medium
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-0197 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 8.8 High
CFME: CSRF protection vulnerability via permissive check of the referrer header
CVE-2014-0087 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.
CVE-2015-7502 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.
CVE-2016-7071 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.
CVE-2016-7047 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.
CVE-2016-7040 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.
CVE-2016-5402 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
CVE-2016-4457 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2024-08-06 N/A
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
CVE-2016-3702 1 Redhat 1 Cloudforms Management Engine 2024-08-06 N/A
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
CVE-2017-15125 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2024-08-05 N/A
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.
CVE-2017-15123 1 Redhat 1 Cloudforms Management Engine 2024-08-05 N/A
A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.