Product:

Cloudforms

(Redhat)
Repositories • https://github.com/paramiko/paramiko
• https://github.com/sinatra/sinatra
#Vulnerabilities 48
Date Id Summary Products Score Patch Annotated
2018-02-28 CVE-2017-12191 A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to. Cloudforms 7.4
2018-07-27 CVE-2017-2639 It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms. Cloudforms, Cloudforms_management_engine 7.5
2018-10-31 CVE-2016-5402 A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. Cloudforms, Cloudforms_management_engine 8.8
2019-06-14 CVE-2019-10159 cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. Cfme\-Gemset, Cloudforms 4.3
2019-11-01 CVE-2013-0186 Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Cloudforms, Manageiq_enterprise_virtualization_manager 6.1
2019-11-04 CVE-2013-4423 CloudForms stores user passwords in recoverable format Cloudforms 5.5
2019-12-13 CVE-2014-0197 CFME: CSRF protection vulnerability via permissive check of the referrer header Cloudforms, Cloudforms_management_engine 8.8
2018-03-02 CVE-2018-1058 A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. Ubuntu_linux, Postgresql, Cloudforms 8.8
2018-03-13 CVE-2018-7750 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. Debian_linux, Paramiko, Ansible_engine, Cloudforms, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_eus, Enterprise_linux_server_tus, Enterprise_linux_workstation, Virtualization 9.8
2018-07-03 CVE-2018-10855 Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. Ubuntu_linux, Debian_linux, Ansible_engine, Cloudforms, Openstack, Virtualization 5.9