PT-2018-10173

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine cfme affected versions not specified Description The issue is related to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could exploit this...

Important: Red Hat Security Advisory: CloudForms 4.6.2 bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Authorization

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087: Undefined Security Weakness

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2017-7528

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...

CVE-2016-4457

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

CVE-2016-4457

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

CVE-2016-4457: Undefined Security Weakness

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

Red Hat CloudForms Management Engine Information Disclosure Vulnerability

Red Hat CloudForms Management Engine is an IaaS Infrastructure as a Service cloud services solution from Red Hat, Inc. The solution creates and manages private and public clouds and has application lifecycle management capabilities. An information disclosure vulnerability exists in the Red Hat...

Information disclosure

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

CVE-2016-3702: Padding oracle flaw in Red Hat CloudForms Management Engine (CFME) 5 enables remote attackers to obtain sensitive cleartext information. Affected component and exact root cause are described as a padding oracle vulnerability; no specific exploit details or remediation are provided ...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

PT-2017-8412

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine CFME version 5 Description A padding oracle flaw allows remote attackers to obtain sensitive cleartext information. Recommendations For CloudForms Management Engine CFME version 5, at the moment, there is no...

CVE-2016-3702: Exposure of Sensitive Information to an Unauthorized Actor

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

Red Hat CloudForms Management Engine Elevation of Privilege Vulnerability

Red Hat CloudForms Management Engine CFME is an IaaS Infrastructure as a Service cloud services solution management engine from Red Hat, Inc. An elevation of privilege vulnerability exists in Red Hat CloudForms Management Engine CFME versions prior to 5.7, which can be exploited by an attacker to...

cfme: RCE via Capacity & Utilization feature

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as...