RHEL 7 : CFME 5.6.2.2 (RHSA-2016:2091)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2091 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments...

CVE-2020-25716

A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest...

Privilege Escalation

cfme-gemset is vulnerable to privilege escalation. The vulnerability exists as an attacker with a specific group can perform actions restricted only to system administrator...

OS Command Injection

cfme is vulnerable to OS command injection. An attacker is able to perform an out-of-band OS Command Injection through the conversion host...

Server-Side Request Forgery (SSRF)

cfme is vulnerable to server-side request forgery SSRF. The vulnerability exists in Ansible Tower Provider...

Privilege Escalation

cfme-gemset is vulnerable to privilege escalation. The vulnerability exists as it is missing access control, leading to escalation of admin group privileges...

Authorization Bypass

cfme-gemset is vulnerable to authorization bypass. The vulnerability exists through missing functional level access control & IDOR lead to compromise...

Authorization Bypass

cfme is vulnerable to authorization bypass. The read-only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violates the expected behavior...

Cross-site Scripting (XSS)

cfme-gemset is vulnerable to cross-site scripting XSS. The vulnerability exists in the report menu title...

Cross-Site Request Forgery (CSRF)

cfme is vulnerable to cross-site request forgery CSRF. The Referrer header is not properly validated, allowing for CSRF attacks...

CVE-2014-3536

CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...

Design/Logic Flaw

CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...

CVE-2014-3536

CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...

CVE-2014-3536

CVE-2014-3536 affects Red Hat CloudForms Management Engine (CFME) version 5. The vulnerability stems from CFME logging RHN account information to top_output.log during the registration process, leading to potential information disclosure. Multiple connected records corroborate the issue as a disc...

CVE-2014-0197

CFME: CSRF protection vulnerability via permissive check of the referrer header...

Cross site request forgery (csrf)

CFME: CSRF protection vulnerability via permissive check of the referrer header...

CVE-2014-0197

CVE-2014-0197 is a Cross-Site Request Forgery (CSRF) vulnerability in CFME/Red Hat CloudForms Management Engine caused by a permissive check of the referrer header. Affected component is CFME web application; impact is partial confidentiality, integrity, and availability compromises per CVSS 3.1/...

CVE-2014-0197

CFME: CSRF protection vulnerability via permissive check of the referrer header...

cfme: Improper authorization in migration log controller allows any user to access VM migration logs

A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs...

CVE-2019-10159

cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available...