Redhat Cloudforms Management Engine vulnerabilities
42 vulnerabilities
Known vulnerabilities in Redhat Cloudforms Management Engine, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-10905redhatcloudforms+2
EPSS score0.47%
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.CVE-2018-10854red hatcloudforms+1EPSS score0.61%
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.CVE-2013-2049redhatcloudforms_management_engineEPSS score1.19%
Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.CVE-2013-2050redhatcloudforms_management_engine+1EPSS score15.66%
SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.CVE-2013-2068redhatcloudforms_management_engineEPSS score58.62%
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.CVE-2013-4172redhatcloudforms_management_engineEPSS score1.26%
The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.CVE-2013-6461debiandebian_linux+8EPSS score2.19%
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsCVE-2013-6460debiandebian_linux+8EPSS score2.08%
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsCVE-2015-7502redhatcloudforms+41EPSS score0.34%
Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.CVE-2016-4457redhatcloudforms_management_engineEPSS score1.06%
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.CVE-2016-7071red hatcfme+7EPSS score2.20%
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.CVE-2016-7047red hatcfme+2EPSS score1.33%
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.CVE-2016-7040redhatcloudforms_management_engine+11EPSS score2.26%
Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.CVE-2016-5402redhatcloudforms+13EPSS score5.93%
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.CVE-2016-3702redhatcloudforms_management_engineEPSS score1.24%
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.CVE-2020-1736debianansible+8EPSS score0.40%
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.CVE-2020-1735debianansible+9EPSS score0.47%
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.CVE-2020-1740alpineansible+11EPSS score0.36%
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.CVE-2020-1738debianansible+7EPSS score0.40%
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.CVE-2020-1733alpineansible+11EPSS score0.40%
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.