Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 131

Export CSV
CVE-2015-7502

CloudForms: insecure password storage in PostgreSQL database

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

CVSS 3.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Cloudforms Management Engine Cloudforms Managementengine
CVE-2016-5383

CloudForms: Lack of field filters on user input

The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Cloudforms Managementengine
CVE-2014-7819

rubygem-sprockets: arbitrary file existence disclosure

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Redhat Sprockets Project
Products
Cloudforms Managementengine Sprockets
CVE-2014-0060

postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

CVSS 2.0 · 4.0 Medium EPSS 4.1% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-3692

CFME: default fallback password in customization_templates.yml

The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges.

CVSS 2.0 · 10.0 Critical EPSS 2.9% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.1 Management Engine Cloudforms Managementengine
CVE-2014-0078

CFME: multiple authorization bypass vulnerabilities in CatalogController

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

CVSS 2.0 · 4.0 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0064

postgresql: integer overflows leading to buffer overflows

Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.

CVSS 2.0 · 6.5 Medium EPSS 5.4% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-3486

CFME: SSH Utility insecure tmp file creation leading to code execution as root

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0066

postgresql: NULL pointer dereference

The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0065

postgresql: possible buffer overflow flaws

Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.

CVSS 2.0 · 6.5 Medium EPSS 5.0% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0184

CFME: root password is written to evm.log when entered during VM provisioning

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-3642

CFME: dangerous send method in performance.rb

vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."

CVSS 2.0 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0.1 Management Engine Cloudforms 3.0.2 Management Engine Cloudforms 3.0.3 Management Engine and 4 more
CVE-2014-0137

CFME: ReportController SQL injection

SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

CVSS 2.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2016-7040

cfme: Incorrect sanitization in regular expression engine

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine Cloudforms Managementengine
CVE-2013-2050

2: miq_policy/explorer SQL injection

SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

CVSS 2.0 · 7.5 High EPSS 15.7% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine Cloudforms Managementengine Manageiq Enterprise Virtualization Manager
CVE-2012-6117

Configserver: Passwords from application blueprint stored plaintext in configserver.log

Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat
Products
1 Cloudforms Cloud Engine