122 matches found
RHEL 7 : CFME 5.6.2.2 (RHSA-2016:2091)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2091 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments...
CVE-2020-25716
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest...
Privilege Escalation
cfme-gemset is vulnerable to privilege escalation. The vulnerability exists as an attacker with a specific group can perform actions restricted only to system administrator...
OS Command Injection
cfme is vulnerable to OS command injection. An attacker is able to perform an out-of-band OS Command Injection through the conversion host...
Server-Side Request Forgery (SSRF)
cfme is vulnerable to server-side request forgery SSRF. The vulnerability exists in Ansible Tower Provider...
Privilege Escalation
cfme-gemset is vulnerable to privilege escalation. The vulnerability exists as it is missing access control, leading to escalation of admin group privileges...
Authorization Bypass
cfme-gemset is vulnerable to authorization bypass. The vulnerability exists through missing functional level access control & IDOR lead to compromise...
Authorization Bypass
cfme is vulnerable to authorization bypass. The read-only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violates the expected behavior...
Cross-site Scripting (XSS)
cfme-gemset is vulnerable to cross-site scripting XSS. The vulnerability exists in the report menu title...
Cross-Site Request Forgery (CSRF)
cfme is vulnerable to cross-site request forgery CSRF. The Referrer header is not properly validated, allowing for CSRF attacks...
CVE-2014-3536
CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...
Design/Logic Flaw
CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...
CVE-2014-3536
CVE-2014-3536 affects Red Hat CloudForms Management Engine (CFME) version 5. The vulnerability stems from CFME logging RHN account information to top_output.log during the registration process, leading to potential information disclosure. Multiple connected records corroborate the issue as a disc...
CVE-2014-3536
CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...
CVE-2014-3536: Insertion of Sensitive Information into Log File
CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...
CVE-2014-0197
CFME: CSRF protection vulnerability via permissive check of the referrer header...
Cross site request forgery (csrf)
CFME: CSRF protection vulnerability via permissive check of the referrer header...
CVE-2014-0197
CVE-2014-0197 is a Cross-Site Request Forgery (CSRF) vulnerability in CFME/Red Hat CloudForms Management Engine caused by a permissive check of the referrer header. Affected component is CFME web application; impact is partial confidentiality, integrity, and availability compromises per CVSS 3.1/...