CVE-2013-2049

Red Hat CloudForms 2 Management Engine CFME allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret...

CVE-2013-2049

CFME/Red Hat CloudForms 2 Management Engine is affected by a vulnerability caused by a static secret_token.rb secret, enabling remote attackers to tamper sessions. Based on provided sources, the impact is session integrity (high for CVSS3) with network access and no authentication; CVSS2/3 base s...

Red Hat CloudForms Management Engine Design Vulnerability

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. A security vulnerability exists in the CloudForms account configuration in Red Hat CFME. An attacker could use the vulnerability to view and change...

cloudforms: XSS in self-service UI snapshot feature

A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP Content Securi...

Moderate: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

Design/Logic Flaw

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CFME: VMRC plugin console grants users administrative access

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

CVE-2017-12191

The CVE-2017-12191 entry describes a CloudForms/Vmware issue where the CloudForms account configuration uses a shared, privileged account for VMRC functions. This flaws allows attackers to view and modify VMRC settings and the controlled virtual machines. Red Hat RHSA-2018:0374 documents a securi...

PT-2018-5381 · Red Hat · Cloudforms

Name of the Vulnerable Software and Affected Versions: CloudForms affected versions not specified Description: A flaw was found in the CloudForms account configuration when using VMware, where a shared account with privileged access to VMRC functions is used by default. This could allow an attack...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

(RHSA-2018:0092) Important: Red Hat CloudForms 4.0 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0091) Important: Red Hat CloudForms 4.5 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0090) Important: Red Hat CloudForms 4.2 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0089) Important: Red Hat CloudForms 4.1 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

Red Hat CloudForms Management Engine ManageIQ Authentication Bypass Vulnerability

Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. ManageIQ is a virtualization manager used in it. A security vulnerability exists in the checkprivileges method of the...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...