CVE-2014-7813

CVE-2014-7813 affects Red Hat CloudForms 3 Management Engine (CFME). The vulnerability allows remote authenticated users to cause a denial of service (resource consumption) through crafted usage involving Ruby on Rails .to_sym calls and lack of garbage collection for inserted symbols. CVSS metric...

Red Hat CloudForms Management Engine Elevation of Privilege Vulnerability

Red Hat CloudForms Management Engine is an IaaS Infrastructure as a Service cloud services solution from Red Hat, Inc. The solution creates and manages private and public clouds and has application lifecycle management capabilities. An elevation of privilege vulnerability exists in the Red Hat...

Red Hat CloudForms Management Engine Elevation of Privilege Vulnerability (CNVD-2017-28783)

Red Hat CloudForms Management Engine is a management engine for IaaS cloud service solutions. A security vulnerability in some of the ways that the Red Hat CloudForms Management Engine handles rails applications allows remote attackers to exploit the vulnerability to submit a specially crafted...

cfme: API leaks any MiqReportResult

A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...

CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497

The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CloudForms: lack of RBAC on various methods in web UI

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...

CVE-2017-7528

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...

Red Hat CloudForms ManageIQ Remote Code Execution Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud services solutions from Red Hat. The solution creates and manages private and public clouds, and has the ability to manage the application lifecycle.ManageIQ is one of the virtualization managers. A security vulnerability...

Red Hat CloudForms Management Engine Information Disclosure Vulnerability

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. An information disclosure vulnerability exists in Red Hat CFME. An attacker could exploit this vulnerability to obtain sensitive information...

Important: Red Hat Security Advisory: CFME 5.7.3 security, bug fix and enhancement update

Updates for cfme, cfme-appliance, cfme-gemset, rh-ruby23-rubygem-nokogiri, and rh-ruby23-rubygem-ovirt-engine-sdk4 are now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

cfme: API leaks any MiqReportResult

A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...

CVE-2016-4457

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

CVE-2016-4457

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

CVE-2016-4471

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...

Code injection

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...

CVE-2016-4471

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...

Default credentials

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...

CVE-2016-4471

CVE-2016-4471 affects ManageIQ/CloudForms prior to 4.1, where remote authenticated users could execute arbitrary code. The vulnerability is documented across multiple feeds with concrete references (NVD entry CVE-2016-4471; CNVD/Red Hat advisories). Affected software is ManageIQ in CloudForms bef...

CVE-2016-4471

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...