677 matches found
Red Hat CloudForms Management Engine Information Disclosure Vulnerability
The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. An information disclosure vulnerability exists in Red Hat CFME. An attacker could exploit this vulnerability to obtain sensitive information...
cfme: API leaks any MiqReportResult
A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...
Important: Red Hat Security Advisory: CFME 5.7.3 security, bug fix and enhancement update
Updates for cfme, cfme-appliance, cfme-gemset, rh-ruby23-rubygem-nokogiri, and rh-ruby23-rubygem-ovirt-engine-sdk4 are now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
CVE-2016-4471
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...
CVE-2016-4457
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...
Default credentials
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...
CVE-2016-4471
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...
Code injection
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...
CVE-2016-4457
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...
CVE-2016-4457
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate...
CVE-2016-4471
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code...
CVE-2016-4457
CloudForms Management Engine (CFME) is affected by CVE-2016-4457 due to a default SSL/TLS certificate used by the web server. Red Hat RHSA-2017:1367 documents that if an attacker could man-in-the-middle during install, they could obtain the private key uploaded with the new certificate, enabling ...
CVE-2016-4471
CVE-2016-4471 affects ManageIQ/CloudForms prior to 4.1, where remote authenticated users could execute arbitrary code. The vulnerability is documented across multiple feeds with concrete references (NVD entry CVE-2016-4471; CNVD/Red Hat advisories). Affected software is ManageIQ in CloudForms bef...
PT-2017-8494 · Red Hat · Cloudforms Management Engine
Name of the Vulnerable Software and Affected Versions: CloudForms Management Engine versions prior to 5.8 Description: The issue is related to a default SSL/TLS certificate in the CloudForms Management Engine. Recommendations: For versions prior to 5.8, update to version 5.8 or later to resolve t...
Red Hat CloudForms Management Engine Information Disclosure Vulnerability
Red Hat CloudForms Management Engine is an IaaS Infrastructure as a Service cloud services solution from Red Hat, Inc. The solution creates and manages private and public clouds and has application lifecycle management capabilities. An information disclosure vulnerability exists in the Red Hat...
CFME: default certificate used across all installs
CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for...
CloudForms: cloudforms fails to properly check certificates when communicating with RHEV and OpenShift and custom CA
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization RHEV and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensiti...
CVE-2017-7497
The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...