Product:

Cloudforms_management_engine

(Redhat)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 42
Date Id Summary Products Score Patch Annotated
2013-08-23 CVE-2013-4172 The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors. Cloudforms_management_engine N/A
2014-01-11 CVE-2013-2050 SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action. Cloudforms_management_engine, Manageiq_enterprise_virtualization_manager N/A
2016-04-11 CVE-2015-7502 Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files. Cloudforms, Cloudforms_management_engine 5.1
2017-06-08 CVE-2016-4457 CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. Cloudforms_management_engine 7.5
2018-01-11 CVE-2014-0087 The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action. Cloudforms_management_engine 8.8
2018-07-27 CVE-2017-2639 It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms. Cloudforms, Cloudforms_management_engine 7.5
2018-07-27 CVE-2017-7497 The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. Cloudforms_management_engine 4.3
2018-10-31 CVE-2016-5402 A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. Cloudforms, Cloudforms_management_engine 8.8
2019-11-22 CVE-2018-10854 cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. Cloudforms_management_engine 5.4
2019-12-13 CVE-2014-0197 CFME: CSRF protection vulnerability via permissive check of the referrer header Cloudforms, Cloudforms_management_engine 8.8