Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2014-7813

CFME: rails .to_sym symbol DoS

Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine
CVE-2014-0078

CFME: multiple authorization bypass vulnerabilities in CatalogController

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

CVSS 2.0 · 4.0 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0137

CFME: ReportController SQL injection

SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

CVSS 2.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0180

CFME: app/controllers/application_controller.rb wait_for_task DoS

The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0184

CFME: root password is written to evm.log when entered during VM provisioning

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-3486

CFME: SSH Utility insecure tmp file creation leading to code execution as root

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-3642

CFME: dangerous send method in performance.rb

vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."

CVSS 2.0 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0.1 Management Engine Cloudforms 3.0.2 Management Engine Cloudforms 3.0.3 Management Engine and 4 more
CVE-2014-0176

CFME: reflected XSS in several places due to missing JavaScript escaping

Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine