CVE-2016-4471

CVE-2016-4471 affects ManageIQ/CloudForms prior to 4.1, where remote authenticated users could execute arbitrary code. The vulnerability is documented across multiple feeds with concrete references (NVD entry CVE-2016-4471; CNVD/Red Hat advisories). Affected software is ManageIQ in CloudForms bef...

CVE-2016-4471

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...

cfme: Privilege escalation causing arbitrary code execution

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...

Red Hat CloudForms Management Engine 5.1 - agent/linuxpkgs Path Traversal

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def...

EVM: Stored XSS

Multiple cross-site scripting XSS vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2050

The CVE-2013-2050 issue is a SQL injection vulnerability in the miq_policy controller of Red Hat CloudForms Management Engine (CFME) 5.1 and older, and ManageIQ Enterprise Virtualization Manager 5.0 and older. The vulnerability leverages the explorer action via the profile[] parameter, allowing r...

PT-2014-2542 · Red Hat +1 · Red Hat Cloudforms +1

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms 2.0 Management Engine CFME versions 5.1 and earlier ManageIQ Enterprise Virtualization Manager versions 5.0 and earlier Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This is...

Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'bcrypt' require 'digest' require 'openssl' class Metasploit4 'Red Hat CloudForms Management Engine 5.1 miqpolicy/explorer SQL Injection',...

Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection

This module exploits a SQL injection vulnerability in the "explorer" action of "miqpolicy" controller of the Red Hat CloudForms Management Engine 5.1 ManageIQ Enterprise Virtualization Manager 5.0 and earlier by changing the password of the target account to the specified password. Module Options...

EVM: CSRF

Cross-site request forgery CSRF vulnerability in ManageIQ Enterprise Virtualization Manager EVM allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors...

2: miq_policy/explorer SQL injection

SQL injection vulnerability in the miqpolicy controller in Red Hat CloudForms 2.0 Management Engine CFME 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile parameter in an explorer action...