CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

CVE-2016-3702: Padding oracle flaw in Red Hat CloudForms Management Engine (CFME) 5 enables remote attackers to obtain sensitive cleartext information. Affected component and exact root cause are described as a padding oracle vulnerability; no specific exploit details or remediation are provided ...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CloudForms: UI security issue on Openstack actions

A number of unused delete routes are present in CloudForms which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting o...

Moderate: Red Hat Security Advisory: cfme, cfme-appliance, and cfme-gemset security, bug fix, and enhancement update

An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Red Hat CloudForms Management App Security Bypass Vulnerability

The Red Hat CloudForms Management Engine CFME App is a management engine application for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. A security bypass vulnerability exists in the Red Hat CFME App. An attacker could exploit this vulnerability to conduct a...

CVE-2017-2653

A number of unused delete routes are present in CloudForms which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting o...

Red Hat CloudForms Management Engine Elevation of Privilege Vulnerability

Red Hat CloudForms Management Engine CFME is an IaaS Infrastructure as a Service cloud services solution management engine from Red Hat, Inc. An elevation of privilege vulnerability exists in Red Hat CloudForms Management Engine CFME versions prior to 5.7, which can be exploited by an attacker to...

CVE-2017-2632

A logic error in validrole in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges...

cfme: tenant administrator can create a group with higher permissions

A logic error in validrole in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges...

Moderate: Red Hat Security Advisory: CFME 5.7.1 bug fixes and enhancement update

Updated cfme packages that fix bugs and add various enhancements are now available for Red Hat CloudForms 4.2. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is buil...

Red Hat CloudForms Management Engine Remote Code Execution Vulnerability (CNVD-2016-11916)

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. A remote code execution vulnerability exists in Red Hat CFME. An attacker could exploit this vulnerability to execute arbitrary code...

Important: Red Hat Security Advisory: CFME 5.6.3 security, bug fix, and enhancement update

An update is now available for Red Hat CloudForms 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

cfme: RCE via Capacity & Utilization feature

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as...

Red Hat CloudForms Denial of Service Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. The solution creates and manages private and public clouds and has the ability to manage the application lifecycle. A denial of service vulnerability exists in Red Hat CloudForms. A remot...

CVE-2016-7071

It was found that the CloudForms did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM...

CFME: bypass authorization by altering VM ID

It was found that the CloudForms did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM...

Important: Red Hat Security Advisory: CFME 5.6.2.2 security, and bug fix update

An update for cfme is now available for Red Hat CloudForms 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Red Hat CloudForms Management Engine Arbitrary Command Execution Vulnerability

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. An arbitrary command execution vulnerability exists in Red Hat CFME version 4.1, which can be exploited by remote attackers to execute arbitrary...

CVE-2016-7040

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections...